Express session not saving/persisting over https using azure app services

Question

I've looked through quite a few issues on this and have tried every combination of "solutions" for my problem but can't seem to figure this one out.

I currently have a client side react application being hosted on azure. Let's call this https://clientside.net for short.

I also have a server side node js application being hosted on azure we'll call this https://serverside.net.

I can't seem to to get the session variables to save upon authenticating users. This works perfectly fine on localhost btw.

e.g. On the client side we are making requests using axios like so:

const headers = {
    withCredentials: true,
    headers: { auth: process.env.REACT_APP_SECRET },
  };
  
axios.get(`${process.env.REACT_APP_SERVER}/get/auth`, headers).then((response) => console.log("blah blah blah"));

On the server side this is how express session is setup...

app.use(
  cors({
    origin: ["https://clientside.net"],
    methods: ["GET", "POST"],
    credentials: true,
  })
);

app.set("trust proxy", 1);
app.use(
  session({
    name: "sid",
    saveUninitialized: false,
    resave: false,
    secret: "shhh",
    cookie: {
      domain: ".clientside.net",
      maxAge: 1000 * 60 * 60 * 8,
      secure: true,
      httpOnly: false,
    },
  })
);

Within our authentication route on server side we are saving session like so ...

req.session.username = req.body.username;
req.session.password = req.body.password;
req.session.save(() =>
    res
      .status(202)
      .json({ 
      authenticated: true, username:        req.session.username})
);

Upon refreshing or attempting to hit any other routes, the req.session.username & req.session.password are nowhere to be found. Is there something wrong with my session config? Or am I perhaps missing something? I appreciate any and all help on this! Thanks y'all

user_7507613 · Answer

I've figure out the issue.

Deploying an application using azure app services, means you will be using a reverse proxy.

In my case nodeiis web service proxy.

The client side makes requests to the iis service which then routes the request to the node server.

I made many changes but the one that got me up and running was switching the cors origin and session domain to be the server side domain/ip like so...

app.use(
  cors({
    origin: ["https://serverside.net"],
    methods: ["GET", "POST"],
    credentials: true,
  })
);

app.set("trust proxy", 1);
app.use(
  session({
    name: "sid",
    saveUninitialized: false,
    resave: false,
    secret: "shhh",
    cookie: {
      domain: ".serverside.net",
      maxAge: 1000 * 60 * 60 * 8,
      secure: true,
      httpOnly: false,
    },
  })
);

Now session variables are able to be successfully saved upon login.

Express session not saving/persisting over https using azure app services

1 Answers