Express-session Secure Cookies not working

Question

When not using secure cookie true setting, my app user login works fine. When I enable secure cookies, the login appears to go through fine, but it seems the cookie is not saved and the user is not logged in.

In other words, this works:

app = express();
app.use(session({
    secret: 'secret code',
    store: sessionStore,
    resave: false,
    saveUninitialized: false,
    cookie: {
        secure: false,
        maxAge: 5184000000 // 60 days
        }
}));

This does not work (user isn't able to log in):

app = express();
app.set('trust proxy');
app.use(session({
    secret: config.cookieSecret,
    store: sessionStore,
    resave: false,
    saveUninitialized: false,
    proxy: true,
    secureProxy: true,
    cookie: {
        secure: true,
        httpOnly: true,
        maxAge: 5184000000 // 60 days
        }
}));

Behind cloudflare and nginx. This is in my nginx config:

location ~ / {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://localhost:3000;
}

From what I read, I think it should work. What am I missing?

EDIT: I am running https with a valid ssl cert.

Answer 1

The combination of settings that worked for me:

• Inside the nginx server configuration, add proxy_set_header X-Forwarded-Proto $scheme;

• Inside the express-session configuration:

  server.use(
    session({
      proxy: true, // NODE_ENV === 'production'
      cookie: {
        secure: true, // NODE_ENV === 'production'
      },
      // everything else
    })
  );
  

Answer 2

Solution if using Heroku:

In Heroku, all requests come into the application as plain http but they have the header X-Forwarded-Proto to know whether the original request was http or https. That causes express to see non-ssl traffic and so it refuses to set a secure cookie when running on Heroku. Express will only send secure cookies over https. You have to tell express to trust the information in the X-Forwarded-Proto header, i.e. that the original request was over https, by enabling the 'trust proxy' setting. Before defining the cookie properties I put

app.set('trust proxy', 1);

Where 1 means trust the first proxy. 1 was good enough for me to set cookie: secure

Answer 3

Apache reverse proxy solution

For those looking for a potential solution and are using an Apache reverse proxy: Make sure to add the following directives above the ProxyPass directives inside the VirtualHost directive for the respective domain:

RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
RequestHeader set X-Forwarded-SSL expr=%{HTTPS}

ProxyPass / http://localhost:8001/
ProxyPassReverse / http://localhost:8001/

This change allowed my cookies to persist.

Additionally, as others have pointed out, don't forget to add the following code to your production (or other hosted environments that use a proxy) express configuration:

  if (app.get('env') === 'production') {
      app.set('trust proxy', 1); // trust first proxy, crucial
  }

Lastly, make sure your cookie/session settings are set up correctly. Check out Stoyan Borov's answer for the minimum requirements. Here's how I set it up:

    app.use(session({
        cookie: {
            sameSite: 'lax', // lax or strict
            secure: process.env.NODE_ENV === 'production', // Crucial
            maxAge: 1000 * 60 * 60 * 24 * 30, // 30 days
        },
        proxy: true, // Crucial
        resave: false,
        saveUninitialized: true,
        secret: 'Gotta love cookies',
        store: yourSessionStore,
        rolling: true,
    }));

Answer 4

That's exactly what secure cookie does. It does not get saved by the browser in an insecure environment, read http://.

You need to add an ssl sert, redirect all http requests to https and then the cookie would get saved in the browser.

Getting https set up on local is irritating, so set secure in a config / environment variable you also set to false on your source control and enable it for prod/ staging.

Edit: Also enable resave, resave: true

Answer 5

My guess is that the actual problem is this:

httpOnly: true

This means that any client-side code cannot access the cookie (through document.cookie), and any XHR ("AJAX") requests that you perform need to explicitly set withCredentials before any cookies will be sent in the request.

It depends on which client-side setup you're using how to do that:

• plain XHR: look at the example code
• fetch: here
• jQuery: use the xhrFields option for $.ajax()
• Angular 1: here
• Angular 2: here

Answer 6

Removing the secret key from cookie-parser seems to do the trick and allow logins for some reason. I was using the same secret key as the session cookie (as the documentation says to do) so I don't understand why it didn't work and yet it worked with unsecure cookies. Leaving the secret key on cookie-parser and enabling session resave true also worked. If anybody can explain this it would be appreciated.

Answer 7

<VirtualHost *:80>
 ServerName xx.com
    ProxyPreserveHost On
<Location "/">

        ProxyPreserveHost On
        ProxyPass http://localhost:8080/
        ProxyPassReverse http://localhost:8080/
        RequestHeader set X-Forwarded-Port "443"
        RequestHeader set X-Forwarded-Proto "https"
</Location></VirtualHost>

Answer 8

app.set('trust proxy', 1); worked like a charm