Session-Cookie not sent in CORS environment

Question

I'm desperately trying to get session cookies to work in my environment, but without luck so far.

My backend is a node/express application, running at port 3000. CORS is enabled like this:

const corsOptions = {
    origin: "http://127.0.0.1:4300",
    allowedHeaders: [ "Origin", "X-Requested-With", "Content-Type", "Accept", "Authorization", "x-xsrf-token" ],
    credentials: true
};
if (isDebug) {
    corsOptions.maxAge = 1;
}
app.use(cors(corsOptions));

I'm using express-session and passport for login. The session is configured like this:

const options = {
    secret: '...',
    cookie: { httpOnly: true }
};

app.use(session(options));

The frontend is an Angular 2 SPA, running at port 4300. When I'm serving the frontend from my express server, everything works as expected. But when not, I'm experiencing the following obscure problem:

The login route returns a cookie with the session ID. But the next request to the backend is sent with a different session ID?! I have no idea, where this different session ID could come from. Especially since the session cookie is marked as HTTP-only.

The HTTP-requests are sent as follows:

const response = this.http.get(url, { withCredentials: true });

I tried the following:

Made sure that third party cookies are allowed in the browser => it was fine.
Tried to set httpOnly to false => no luck.
Experimented with cookie domain: set it to the address of the backend - no luck. Then to the address of the frontend - didn't work either.
Cleared browser and cookie caches, tried out Google Chrome and Edge. Nothing helped.

Does anybody have an idea which part of the puzzle is missing?

Thanks a lot, Steven

Session-Cookie not sent in CORS environment

1 Answers