Express/Node js api SameSite=None and Secure for cookies ,warning being shown when trying to access the api

Viewed 68

I have the following api created using express/node but when i try to access it from the browser "Specify SameSite=None and Secure if the cookie should be sent in cross-site requests. This enables third-party use." this warning was shown in console and no data was retrieved ,the api is as follows

let express = require("express");
let app = express();
let bodyparser = require("body-parser")
let jwt = require("jsonwebtoken");
const student = require('./student')


app.use(bodyparser.json)

//used to authenticate the user and create the token
app.get("/auth",(req,res)=>{
    console.log("sdsdsds")
    var token = jwt.sign({email: user.email}, 'hubDemo', {expiresIn: '1h'});
    res.send({token})
})

//fetches the student data and returns 
app.get("/student",(req,res)=>{
    console.log("tst");
    return res.status(200).json({
        ok: true,
        data: student
    });
});


app.listen(3000,()=>{console.log("listening")})

what should i change to make it work?

1 Answers

So in your given scenario, no cookies are being signed our utilized with your express api. However, in the case of your tokens, I would highly recommend looking into http-only cookies rather than localStorage. This prevents any clientside adjustment of the token, while localStorage is more prone to attacks. But depending on your origin-url, just indicating the SameSite property when creating the cookie should solve the warning.

Related