Can't read 'httpOnly: false' Cookie

Question

I have an express server that has written a cookie, but I can not access it from the client side. I can see it in the Chrome dev tools, it is NOT marked as being httpOnly or Secure, yet when I try to access it via my React app or even just by typing document.cookie in the browser console, I get nothing.

Right now the express server is running on Heroku, and my client side is localhost.

I'm stumped.

Here is my server side code that is setting the cookie:

return res .status(200) .cookie('id_token', token, { httpOnly: false, path: '/', secure: false, maxAge: 400000 }) .json({ token: token });

1.) What's your React code? 2.) Are you using the cors package on server? — Colin Burke
– Colin Burke, Commented Nov 21, 2018 at 23:35
I'm using 'universal-cookie' const cookies = new Cookies(); const token = await cookies.get('id_token'); — Zach G
– Zach G, Commented Nov 22, 2018 at 1:28
On the server I'm just using what's build into express to set the cookie. — Zach G
– Zach G, Commented Nov 22, 2018 at 1:31
Strange. It's likely an issue with the order of your middlewares. — Colin Burke
– Colin Burke, Commented Nov 22, 2018 at 12:13

Community · Accepted Answer · 2020-06-20 09:12:55Z

Express server is running in heroku and Client server is running in localhost.

The cookie set in the Express server is scoped to the current host when Domain for the cookie isn't set. ^[1]

Say your application is served at express.herokuapp.com, scripts can only read it when they're running in the same host. i.e. express.herokuapp.com

However, with cookie scopes cookie set on a domain can be read by scripts running in a subdomain.

In development, you can set Domain attribute for the cookie to be .herokuapp.com

For production, I strongly suggest to explicitly scope the cookie to the client domain. While you can apply the same process as development if client and server are running in different subdomains. You should only do this if other client apps running in other subdomains share cookies.

However if both client and server are going to be running in the same domain, I suggest to keep the default cookies scope.

If client and server are running in different domains, I strongly suggest to explicitly scope the cookie to the client domain.

Then add the following entry in your /etc/hosts to alias localhost to a subdomain of herokuapp.com

127.0.0.1 local.herokuapp.com

Visit the address alias and the client side script will read the cookie.

Collectives™ on Stack Overflow

Can't read 'httpOnly: false' Cookie

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related