My Node JS (express) server sends a cookie called "token", which I am using as auth token.
User gets a cookie called "token" via cookie with some contents when user logs in, and user gets a cookie called "token" (same name) with "" for its value. Empty string so that it replaces previous token contents inside the cookie.
All requests are made in https (not http), and below res.cookie is used for setting the cookie for both login and logout.
res.cookie('token', '', {
expires: new Date(Date.now() + 10 * 1000),
httpOnly: true,
domain: '.mydomain.com',
secure: true
})
It works perfectly fine on Chrome... but on Chrome only.
On FireFox, the user DOES get the cookie fine when user logs in, but the console shows following error.
Cookie “token” will be soon treated as cross-site cookie against “[my request url]” because the scheme does not match.
Also, when user logs out, the browser won't receive "token" cookie with empty string so the user stays logged in... The previous cookie remains intact so user just stays logged in unless manually deleting the cookie.
I fixed the code so that cookies are secure: true & sameSite: "Lax", but it still does not work for FireFox. Previous cookie with token value is not overridden by the new cookie with empty string (user just remains logged in).
How can I fix this so that my log in & log out feature works fine on FireFox as well as on Chrome?
Help will be very much appreciated.. thank you.