1

Vite + React: http://localhost:5173

Express: http://localhost:3000

Here is the code in the express server's login route:

const mycookie = cookie.serialize("jwt", refreshToken, {
    httpOnly: true, // Set the HTTP-only flag
    secure: true, // Set the secure flag
    sameSite: "none", 
    path: "/", // Set the path of the cookie to '/'
    maxAge: 3600, // Set the maximum age of the cookie to 1 hour
  });

  // Set the cookie in the response headers
  res.setHeader("Set-Cookie", mycookie);

  res.json({
    accessToken,
    refreshToken,
  });

Here is my cors config:

const allowedOrigins = require("./allowedOrigins");

const corsOptions = {
  crendials: true,
  origin: function (origin, callback) {
    console.log(allowedOrigins.indexOf(origin));
    if (allowedOrigins.indexOf(origin) !== -1) {
      callback(null, true);
    } else {
      callback(new Error("Not allowed by CORS"));
    }
  },
};

Here is my handleSubmit function in the frontend (gets called when the user clicks submit):

const handleSubmit = () => {
    console.log("Login");
    // axios.defaults.withCredentials = true;

    axios.post("http://localhost:3000/api/v1/auth/login", { email, password });
  };

Whenever the request is made to the server. The response header does contain the set-Header to set the jwt token but I am not able to see it in my applications tab under cookies in devtools. A pre-flight request also comes in which probably clears the cookie.

My networks tab:

enter image description here

The xhr request:

enter image description here

The OPTIONS request:

enter image description here

The Applications tab:

enter image description here

However, when I disable CORS in the browser, the cookie is getting set.

Networks tab (NOTICE: No PreFlight request)

enter image description here

Applications tab:

enter image description here

I tried working out different answers from stackoverflow answers like this, this, this, and many more along with a reddit post on a similar issue but nothing has worked.

P.S. : I already tried using credentials: true

sideshowbarker
  • 81,827
  • 26
  • 193
  • 197
noobCoder19
  • 26
  • 1
  • 4
  • Your immediate issue has got nothing to do with CORS. An insecure Web origin (e.g. one that uses `http` as its scheme) cannot set a `Secure` cookie. – jub0bs Feb 19 '23 at 23:05
  • I tried commenting the line secure: true, it doesn't work..... And if a secure cookie cannot be stored in http scheme, why does it get stored in a CORS disabled browser. – noobCoder19 Feb 20 '23 at 04:00
  • Commenting out `Secure: true` isn't enough because `SameSite: None` requires `Secure` (at least in Chromium browsers). I'm not entirely sure what you mean by "CORS-disabled browser", but I'm guessing that running the browser with the `--disable-web-security` flag disables more security checks than those covered by the Same-Origin Policy. – jub0bs Feb 20 '23 at 07:20
  • @noobCoder19 did you found a solution for this? I have the same issue in my nextjs, express nodejs app. set-cookie is displaying in the response header. – asela daskon Jul 07 '23 at 06:11

0 Answers0