Express not setting Cookie

Question

I have 2 servers. One hosting a next.js application on localhost:5555 and another hosting an express server for the api on localhost:4444.

The authentication api returns a cookie however this is not being set in the browser running on localhost:5555.

  res.cookie('cokkieName', 'bob', {
        domain: '127.0.0.1:5555',
        maxAge: 900000,
        httpOnly: true,
    });

    res.status(200).json({
        session: jwtSigned,
        role: 'default',
    });

My cors setup is:

const options: cors.CorsOptions = {
    allowedHeaders: ['Origin', 'X-Requested-With', 'Content-Type', 'Accept', 'X-Access-Token', 'Authorization'],
    credentials: true,
    methods: 'GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE',
    origin: 'http://localhost:5555',
    preflightContinue: false,
};

I'd prefer to set the cookie with the api rather than on the via next.js.

I've tried alternating the cors settings but have had no success. The client call uses axios and has withCredentials set.

Answer 1

As mentioned in the other answer, you cannot set cookie on a different domain, as it can be a security risk.

But from your question...

Since the API server is running the authentication logic, the cookie should be set on the API server domain, NOT on client domain

So in your API server, you can change code to

res.cookie('cokkieName', 'bob', {
        domain: '127.0.0.1:4444',
        maxAge: 900000,
        httpOnly: true,
    });

or just remove the domain as it defaults to server domain.

res.cookie('cokkieName', 'bob', {
            maxAge: 900000,
            httpOnly: true,
 });

As you have a client running on localhost:5555 and API server running on localhost:4444, it's a cross domain call and you need to pass withCredentials option to axios to pass the cookie. You might not be able to see the cookie in browser, as it can be a security risk, but can echo the cookie value on server console.

axios.get("url",{
    withCredentials: true
    }).then(res => {
            console.log(res);
    });

Note that credentials option work only if Access-Control-Allow-Origin header is not a wildcard like *

I have a created a server to mimic the code you posted. The server basically echoes the request cookie back.

It can be accessed through this stackblitz. You can toggle the withCredentials flag to see the difference in response

Answer 2

You can not set a cookie for other domains, Because that would be an enormous security risk.

But if you are looking for a way to share a cookie between your applications, the only way you have is to share a single domain between these applications, either separate them by url prefix or create one of them as a subdomain of other.

domain.com and api.domain.com. This way by specifying domain.com in your cookie both domains have access to it

If you concern about developing environment of yours, you can use Nginx and proxy_pass these two applications in single domain