Cookies aren't sent if secure flag set previously

[geiszla]

Cookies aren't sent if secure flag set previously

[geiszla]

Okay, I just figured it out: if I use different names for the cookies depending on the environment, it will work on both HTTPS and HTTP.

[dougwilson]

Very strange. I'm also not 100% sure what is going on there. Is it possible to provide a simplified app I can run to reproduce the issue (include instructions on how to run and reproduce too)?

[geiszla]

Thanks for the quick response! I have a project on github with this issue. npm run build builds with production, and npm run dev builds it for dev. Then you can run npm start either with or without --production to start it for production/development.

If it's too complex project to debug, I can make a simple PoC, but I hope it's not too bad.

[dougwilson]

Awesome thanks! I will try to run it when I get to a computer. After I run it, what are the next steps I would need to perform to see the issue?

[geiszla]

The app is basically just a boilerplate/starter, so it only consists of a login page and a home page. If you go to either http://localhost:8080 (for development) or https://localhost/ (for production), the login screen should appear and if the cookies are working you can log in with any username and testpass as password.

The problem is, when I log in to the HTTPS version, then build it for dev and start it without --production and load the login page, no cookies are loaded (webpack replaces the process.env.NODE_ENV with the environment string when building, so you need to rebuild it when changing between dev/prod).

[dougwilson]

Yes, I can reproduce. There is no solution from this module. It is just how web browsers work: cookies are per domain and do not care about the port number. Since both are localhost, the two sites share the same cookie space. Since the cookie was set with the secure flag, the browser will not sent it over http and won't allow it to be replaced over http. You have to clear your cookies between the two.

[geiszla]

Would it be possible to use different session cookies when using HTTP, so that it doesn't try to get the secured ones?