我有一个使用 Express 的 Node 应用程序,我尝试为我的客户端设置 cookie。它在本地环境(http)上运行良好。但是一旦我投入生产(https),我就很好地收到了cookie(我可以在响应中看到它),但它没有设置。任何想法?
Nginx 配置:
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
gzip on;
server {
listen 443 ssl default_server;
listen [::]:443 default_server;
server_name back.domain.com;
ssl_certificate /etc/letsencrypt/.../fullchain.pem;
ssl_certificate_key /etc/letsencrypt/.../privkey.pem;
location / {
proxy_pass http://localhost:5000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
}
}
}
节点应用程序:
const api = express()
api.enable('trust proxy')
api.use(cors({origin: 'https://front.domain.com', credentials: true}))
api.post('/login', (req, res) => {
// validate credentials and generate token
// set expires to 24h
res
.cookie('token', token, {expires, httpOnly: true, secure: true})
.sendStatus(204)
})
Front:
// I use the axios lib
axios({
baseURL: 'https://back.domain.com',
url: '/login',
withCredentials: true,
method: 'POST'
}
经过几个小时的研究后我发现......我必须设置domain
key to domain.com
当我创建cookie时:
res
.cookie('token', token, {expires, httpOnly: true, secure: true, domain: 'domain.com'})
.sendStatus(204)
本文内容由网友自发贡献,版权归原作者所有,本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容,请联系:hwhale#tublm.com(使用前将#替换为@)