Some req.session variables not saving (express-session)

Question

I am setting up an OAuth2 flow that needs to send some extra variables to the callback. When I check req.session in the authorize call, the values for the variables are properly set. The next step is to hit the "callback" route.

router.post('/api/personas/authorize', async (req, res) => {
    
    const source = await personaController.getSourceInformation(req.body.source)
    req.session.exchangeURL = source.token_exchange_url;
    req.session.exchangeFields = source.exchange_fields; 
    console.log('REQ', req.session)
    req.session.save()
    const url = constructAuthURL(source)
    res.send(url);

})

In the console.log('REQ') call, both the exchangeURL and exchangeFields variables are set properly.

Then, we hit the callback route:

router.get('/callback', async (req, res) => {
    console.log(req.session)
}

Those exchange variables are not set. The sessionIDs are the same between the calls and the sid cookie is being sent in both requests. Additionally, in both requests, there are some custom variables that are retained between the calls. It appears that just the variables set at /authorize are not persisted.

Any help would be greatly appreciated and I am happy to provide more info!

EDIT:

Here are the headers from the request that hits 'api/personas/authorize':

{
  host: 'localhost:3000',
  connection: 'keep-alive',
  'content-length': '15',
  accept: 'application/json, text/plain, */*',
  'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36',
  'content-type': 'application/json;charset=UTF-8',
  origin: 'http://localhost:3000',
  'sec-fetch-site': 'same-origin',
  'sec-fetch-mode': 'cors',
  'sec-fetch-dest': 'empty',
  referer: 'http://localhost:3000/personas',
  'accept-encoding': 'gzip, deflate, br',
  'accept-language': 'en-US,en;q=0.9',
  cookie: 'connect.sid=s%3AK01XQwFSwwA_q-D8OxALcx--asG23hsB.%2B8j%2BgLX6Eg%2FHhyh3K5wv%2FqpM6Vmp89xX5Kh8%2FFhLMJg'
}

And here are the headers from the request that hits '/callback':

  headers: {
    host: 'localhost:3000',
    connection: 'keep-alive',
    'upgrade-insecure-requests': '1',
    'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36',
    accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'sec-fetch-site': 'cross-site',
    'sec-fetch-mode': 'navigate',
    'sec-fetch-dest': 'document',
    referer: 'https://{XXXX}.salesforce.com/',
    'accept-encoding': 'gzip, deflate, br',
    'accept-language': 'en-US,en;q=0.9',
    cookie: 'connect.sid=s%3AK01XQwFSwwA_q-D8OxALcx--asG23hsB.%2B8j%2BgLX6Eg%2FHhyh3K5wv%2FqpM6Vmp89xX5Kh8%2FFhLMJg'
  }

Some req.session variables not saving (express-session)

0 Answers