Cookies not setting in production

[expressjs]

Cookies not setting in production

[joewagner]

@adamkb33 If you are using two different domains for production, i.e. one for your api and one to serve your html+css+js, then those two domains are not going to have access to the same cookies without setting up CORS. Even then browsers don't always behave the same so things can be tricky.
Here is a good SO question+answer that might help you find a solution: https://stackoverflow.com/questions/46288437/set-cookies-for-cross-origin-requests
FWIW IMO the simplest and most likely to be secure is setting up a reverse proxy so everything lives under the same domain.

[dougwilson]

It is probably no an issue with this package, as this package has no functionality to set cookies at all. It just reads the incoming Cookie header and places them in to req.cookies. All of the API is documented in the README here. Are you getting a Cookie header from the client?

[adamkb33]

Thanks for answering even if this has nothing to do with the package... I just have struggled to understand how setting cookies and getting cookies works.

I am getting the cookie to the client. But it is not setting the cookie. My first approach was to set the cookie manually inn the client but was wondering if there was a easier way since i works on local host. But i have read that this type of approach work only on same site i.e between subdomains. Can you confirm this?

[dougwilson]

I totally understand, cookies can be complex with various security segments in the web browsers. I have to admit, my front end knowledge is rusty, especially with all the changes the web browsers keep making. I'm not sure how to answer your question, I am sorry.

[AtilMohAmine]

Based on the information provided, it appears that you've correctly identified the potential need for adjusting the SameSite attribute to 'None' in your cookie options to facilitate cross-site requests. This adjustment is crucial for enabling proper functionality, particularly in production environments.

response.cookie('jwt', accessToken, {
      maxAge: 15 * 60 * 1000,
      httpOnly: true,
      secure: env === 'production' ? true : false,
      sameSite: 'None'
    });

To delve deeper into this topic, please refer to the MDN documentation.