0

I am working on a nodejs backend and react front-end application with jwt authentication features. When authenticating users I need to send cookies to the client via Set-cookie header. It works fine when I use localhost, but after deploying it on render it does not work. The cookies are not getting saved. On the network tab, it gives a warning This attempt to set a cookie via Set-cookie header was blocked because its Domain attribute was invalid with regard to the current host url.

Network tab enter image description here

Cookies in response enter image description here

This is my cookie configuration file

import urls from './urls.js';

const { hostname } = new URL(urls.CLIENT_URL);
const domain = `.${hostname.split('.').slice(-2).join('.')}`; //.onrender.com

const access = {
    name: process.env.COOKIE_ACCESS_NAME,
    options: {
        sameSite: 'none',
        domain,
        httpOnly: false,
        secure: true,
        maxAge: process.env.ACCESS_EXP,
    },
    delete: {
        sameSite: 'none',
        domain,
        httpOnly: false,
        secure: true,
        maxAge: new Date(null),
    },
};

const refresh = {
    name: process.env.COOKIE_REFRESH_NAME,
    options: {
        sameSite: 'none',
        domain,
        httpOnly: true,
        secure: true,
        maxAge: process.env.REFRESH_EXP,
    },
    delete: {
        sameSite: 'none',
        domain,
        httpOnly: true,
        secure: true,
        maxAge: new Date(null),
    },
};

export default { access, refresh };

Here, I have tried changing the domain as

(Have typed manually to check on const domain = domain-name)

Noting works. What is the issue here?

BLIND
  • 61
  • 10
  • 1
    I think https://stackoverflow.com/a/75753187/1427878 has the answer: _"`run.app` and `a.run.app` cannot be used as they are included in the Mozilla Foundation’s Public Suffix List. There is a [great article about this issue](https://devcenter.heroku.com/articles/cookies-and-herokuapp-com) on Heroku documentation."_ - and if you check the actual list, https://publicsuffix.org/list/public_suffix_list.dat, you will find that `onrender.com` is on there, too. – CBroe Aug 11 '23 at 11:14

0 Answers0