Can't get session to save/persist on deployed express server

Viewed 241

My attempts at logging in are not getting saved to express session in production. I am saving the session in Mongo Store and the sessions are coming up in MongoAtlas as modified (they way they should appear), but for some reason the server is not recognizing that there is an existing session and is making a new one. When I enable express-session debug, it logs express-session no SID sent, generating session on each request to the server. This makes me think that the session id isn't getting sent with the request and that the problem has something to do with my client and server being on different domains (my client address is https://example.com and my server is on https://app.example.com. I originally had my client on https://www.example.com but changed it thinking that the cookie was getting mistaken for a 3rd party cookie (maybe it still is).

My client is hosted on Firebase Hosting and my Express server is hosted on Google Cloud Run

my express-session settings

app.set('trust proxy', true)
app.use(session({
   secret: 'myappisasecret', 
   resave: false,
   saveUninitialized: false,
   secure: true,
   store: new MongoStore({mongooseConnection: mongoose.connection}),
   cookie: {
       maxAge: 1000 * 60 * 60 * 24 * 7, // 1 week
       sameSite: 'lax',
       secure: true,
       domain: 'mysite.com'
   },
   proxy: true // I think this makes the trust proxy be useless 
}))

Below is my coors server stuff. This code is located above the code above, but I don't think it is causing any issues, but think that it might be important to include.

let whitelist = ['https://app.example.com', 'https://www.example.com', 'https://example.web.app', 'https://example.com']
let corsOptions = {
   origin: (origin, callback) => {
       if (whitelist.indexOf(origin) !== -1 || origin === undefined) {
           callback(null, true)
       } else {
           console.log('Request Origin blocked: ', origin)
           callback(new Error('Request blocked by CORS'))
       }
   },
   credentials: true
}
 
 
app.use(cookieParser('myappisasecret'))
app.use(cors(corsOptions))

Since the server wasn't receiving a session id, I thought that maybe my client wasn't sending one so I added credentials: 'include' to my client request code

const reqHeaders = {
            headers: {
                "Content-Type": "application/json"
            },
            credentials: 'include' as any,
            method: "GET"
        }
fetch('https://app.example.com/u/loggedIn', reqHeaders)
        .then(res => etc...

When this request gets submitted expression-session debug logs: express-session saving z3ndMizKoxivXR0N9LBZYkPhDG65uvF2 and then express-session split response

This makes me think that as it tries to save my user data to the session, it gets overwritten at the same time with an initial session data. I have set resave: false. But even then I still get express-session no SID sent with every request sent to the server.

1 Answers
Related