ExpressJs: Browser not sending cookies set for another domain set by api server

Viewed 21

I have an admin dashboard react app that's running on admin.localhost.com:3000. I have an api server that's running on www.localhost.com:1337, and we have one react app for all clients, but each client uses it on a subdomain, for example, abc.localhost.com:4200, bcd.localhost.com:4200.

So from my admin dashboard I'm trying to log into abc as a client. The api server, when requested, verifies the admin, sets the cookie in the response for abc.localhost.com:4200 and responds with link for the client https://abc.localhost.com/home. The browser code passes the link to window.open().

However, if I check the browser tab for https:abc.localhost.com:4200, I don't see the cookie, so obviously the authentication fails.

res.cookie('token', token, {
        secure: true,
        domain: `abc.localhost.com:4200`,
        sameSite: 'Lax',
        maxAge: moment()
          .add(10, 'minutes')
          .valueOf(),
      })

withCredentials is enabled for the client side agent, and the api server is configured accordingly.

1 Answers

It can't be done, server running on www.localhost.com:1337 can't set cookies for abc.localhost.com:4200. Allowing that would be apocalyptic.

Related