0

I am working on a MERN app that requires dynamic subdomains for each company (e.g. companyname.localhost). To achieve this, I have added the line

DANGEROUSLY_DISABLE_HOST_CHECK=true

in my .env file.

When a user logs in at localhost:3000, cookies are created and the user is authenticated. If the user is registered with a specific company, they should be redirected to companyname.localhost while remaining logged in. However, upon redirecting to the subdomain, all cookies that were created on localhost are lost and the user is redirected to the login page again. I expected the cookies to persist on the subdomain and enable the user to remain logged in. Can someone please assist me with this issue? Thank you.

James Z
  • 12,209
  • 10
  • 24
  • 44
Abdullah
  • 1
  • 2
  • I have tried it but it didnt work ,can you assist me with some more details ,thank you – Abdullah Mar 26 '23 at 08:59
  • Consider not using `localhost` for your local development. It's a top-level domain. I imagine you'll run into issues using it in development that you won't run into in production (or vice versa). – Cully Mar 26 '23 at 16:40
  • Tried it also,Doesnt work – Abdullah Mar 27 '23 at 07:45

1 Answers1

0

It's not safe to disable host checking as it can make your app vulnerable to DNS Rebinding attacks. Instead, you should configure a proxy server to handle your subdomains.

Regarding the issue with cookies being lost after the redirect, this is because cookies are domain-specific. If a cookie is set for localhost, it can only be accessed on localhost. Similarly, a cookie set for a specific subdomain can only be accessed on that subdomain.

To make your cookies accessible on subdomains, you need to set the domain property of the cookie to the parent domain. In your case, you should set the domain property to ".localhost" instead of "localhost".

For example, when setting a cookie using JavaScript, you can set the domain property like this:

document.cookie = "mycookie=test; domain=.localhost; path=/";

This will make the cookie accessible on all subdomains of localhost, including companyname.localhost.

I hope this helps you resolve your issue.

BIKI DAS
  • 43
  • 4