0

i am having issues with axios always creatingh a new session for every request it makes.

This is my server.js in my backend:

import express, { json } from "express";
import { connect } from "mongoose";
import cors from "cors";
import { serve, setup } from "swagger-ui-express";
import swaggerDocument from "./config/swagger.json" assert { type: "json" };
import session from "express-session";
import authConfig from "./config/auth.config.js";

const app = express();

let corsOptions = {
    origin: 'http://127.0.0.1:5173',
    credentials: true
};

app.use(cors(corsOptions));
app.use(json());
app.use(session({ 
    secret: authConfig,
    resave: false,
    saveUninitialized: false,
    cookie: { maxAge: 60000 }
}));

//die adresse muss hier eventuell angepasst werden, siehe Wiki
connect("mongodb://localhost:27017/web2print")
    .then(() => console.log("db connected"))
    .catch((err) => console.log(err.message));

app.get("/", (req, res) => {
    res.send({
        message: "Server is running",
    });
});

import productRoutes from "./routes/product.routes.js";
app.use(productRoutes);

import userRoutes from "./routes/user.routes.js";
app.use(userRoutes);

import orderRoutes from "./routes/order.routes.js";
app.use(orderRoutes);

app.use("/api-docs", serve, setup(swaggerDocument));

//diese Funktion beim ersten start ausführen damit die DB mit den Produkten befüllt wird
//import init from "./config/init.js"
//init();

app.listen(8080, () => {
    console.log("Server listening on: http://localhost:8080");
});

Here i create the axios instance in my frontend:

import axios from 'axios'
import rateLimit from 'axios-rate-limit'

axios.defaults.withCredentials= true

const http = axios.create({
  baseURL: 'http://localhost:8080',
  withCredentials: true,
  headers: {
    'Content-type': 'application/json'
  }
})

const httpLimited = rateLimit(http, {
  maxRequests: 2, //maximale Anzahl an Anfragen pro Intervall
  perMilliseconds: 1500 //Intervall in ms
})

export default httpLimited

And i use these methods for requests:

import http from './index'

export default {
  storeConfig(config, files) {
    delete config.bild
    let data = {
      config: config,
      pdf: files.pdf
    }
    if (files.pdfCover) data.pdfCover = files.pdfCover
    return http.post(`/orders/store-config`, data, {withCredentials: true})
  },

  getConfig() {
    return http.get(`/orders/config`, {withCredentials: true})
  }
}

In this controller i log the sessionID and it always shows a new ID:

orderController.storeConfig = async (req, res) => {
    console.log(req.sessionID)
    try {
        let config = req.body.config;
        let pdf = req.body.pdf;
        let pdfCover = req.body.pdfCover;
        let priceObj = await getPrice(config);
        if (!priceObj.success) throw new CustomError(500, priceObj.error);
        //if price is anything but a number throw error
        if (Number.isNaN(priceObj.price) || typeof priceObj.price != "number")
            throw new CustomError(500, "Error in price calculation");

        req.session.config = config;
        req.session.pdf = pdf;
        req.session.pdfCover = pdfCover;
        req.session.price = priceObj.price

        let response = {
            config: req.session.config,
            pdf: req.session.pdf,
            price: req.session.price
        };
        if (req.session.pdfCover) response.pdfCover = req.session.pdfCover;
        res.status(200).send({
            success: true
        });
    } catch (error) {
        console.error(error);
        res.status(error.statusCode || 500).json({ error: error.message });
    }
};

Whats weird is that when i do the exact same requests with postman instead of axios, it works and the session is the same for every request.

As you can see i already tried using:

{withCredentials: true}

and

axios.defaults.withCredentials= true

but it did not hepl.

Thanks in advance!

  • Cookie is sent only CORS rule fulfilled; client and server be at the same origin, else, nothing will be sent. https://stackoverflow.com/questions/43002444/make-axios-send-cookies-in-its-requests-automatically and https://twin.sh/articles/11/react-fix-issue-with-session-changing-after-every-request. It is a browser security policy, which does not apply in Postman. – Raeisi Jun 08 '23 at 17:59

0 Answers0