Express-session in Internet Explorer

Question

I configure the express-session plugin like this:

var express = require('express'),
    session = require('express-session'),
    uuid = require('node-uuid');

var expiration_day = new Date('9/15/2015'),
    today = new Date(),
    session_life = Math.abs(expiration_day.getTime() - today.getTime());

var config = {
    name: 'mycookie', // session ID cookie name
    key: 'mycookie', // session ID cookie name
    secret: '$FGDFH$W#WEgfgdf',
    hash: {
        salt: '9883hjHFIDSU&U#H'
    },
    store: new MongoStore({mongooseConnection: db}),
    unset: 'keep', //never remove expired sessions
    saveUninitialized: true, //always create session, even if nothing is stored
    resave: false, //don't save session if unmodified
    ttl: session_life,
    autoRemove: 'disabled', //disable expired sessions cleaning
    genid: function (req) {
        "use strict";
        return uuid.v4();
    },
    cookie: {
        path: '/api', // cookie will be stored for requests under '/api'
        httpOnly: false,
        domain: 'example.com',
        secure: false,
        expires: expiration_day,
        maxAge: session_life
    }
};

app.sessionMW = session(config);//session middleware

In the Chrome and Mozilla Firefox browsers, only one session is created for the user. This session is available on all routes that use the sessionMW middleware. So if you do a GET or POST request to /api/users/ or /api/sessions, the same session id is stored in a cookie and is sent in the cookie header for each request.

Internet Explorer does not work that way. For each request, a new session is created. The session is stored on the server and I have confirmed that there is a new cookie in the browser for each route of the application.

I have defined the domain, the path and the expiration in the cookies. The cookie in IE shows these values.

I do not use cookieParser, so that can't be the problem.

The problem seems to be on the client-side, anyway. Internet Explorer is not sending the Cookie header with the request. It receives the set-cookie header in the response for each request. But the data is never re-used on subsequent requests.

Could this be a CORS issue? The cookie is not for the same domain on which I am running the application. I need a session on all routes of the API hosted on another domain.

The client-side is configured to include cookies in CORS requests:

$.ajaxSetup({
    cache: false,
    xhrFields: {
        withCredentials: true //all AJAX requests should include Cookie data
    }
});

I send these accept-control headers in the response to each request:

Access-Control-Allow-Credentials: true

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type,

Accept Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH

Access-Control-Allow-Origin: http://example.com

Why is IE not setting the Cookie header in the requests? The domain does not have underscore in its name and it does not start with a number.

Answer 1

For those of you using fetch be sure to set the credentials to include

fetch('/url/', { credentials: 'include' });

Otherwise the session Id will not be included with the request in IE Edge