node.js - Express JS/Node JS : Browsers are not setting cookie when secure=true, sameSite: 'none'

Question

如果我在本地运行服务器，它会设置 cookie，但是当它在线托管时:

如 安全=假，相同站点:“无”然后我收到以下错误

Cookie “connect.sid” will be soon rejected because it has the“sameSite” attribute set to “none” or an invalid value, without the“secure” attribute. To know more about the “sameSite“ attribute, readhttps://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

然后我尝试使用 secure=true

如果安全=真，相同站点:'无'然后我知道它应该可以工作，

it works and the cookies are set when the server is hosted locally.But when it is hosted in heroku the cookie are not set, and I get noerror.

好像客户端网站不安全，但它在 url 框中显示 https

What am I doing wrong here?

session 配置:

router.use(
    session({
        cookie: {
            secure: true,
            maxAge: 86400,
            sameSite: "none",
        },
        secret: process.env.SESSION_SECRET,
        resave: false,
        saveUninitialized: false,
    })
);

注意:我已经启用了凭据设置为 true 的 cors
XHR cookie 选项卡中的 cookie 选项卡为空
前端和后端分别托管在heroku中
XMLHttpRequest 用于发送 withCredentials 设置为 true 的 post 请求。
XHRPOSThttps://sih-drs-prototype-backend-2.herokuapp.com/api/outrages/login
[HTTP/1.1 200 OK 1625ms]
邮政
https://sih-drs-prototype-backend-2.herokuapp.com/api/outrages/login
状态200
好的
版本HTTP/1.1
Transferred367 B(2 B尺寸)

Access-Control-Allow-Credentials
    true
Access-Control-Allow-Origin
    https://tempautocomplete.herokuapp.com
Connection
    keep-alive
Content-Length
    2
Content-Type
    application/json; charset=utf-8
Date
    Sun, 12 Jul 2020 14:06:42 GMT
Etag
    W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Server
    Cowboy
Vary
    Origin
Via
    1.1 vegur
X-Powered-By
    Express
    
Accept
    */*
Accept-Encoding
    gzip, deflate, br
Accept-Language
    en-US,en;q=0.5
Connection
    keep-alive
Content-Length
    46
Content-Type
    application/json;charset=UTF-8
Host
    sih-drs-prototype-backend-2.herokuapp.com
Origin
    https://tempautocomplete.herokuapp.com
Referer
    https://tempautocomplete.herokuapp.com/static/
User-Agent
    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

Answer 1

问题不在于表达 session ，它完成了它的工作。
当响应来自第 3 方域时，浏览器不允许使用 cookie。

if you are looking for a workaround try this npm package :should-send-same-site-nonehttps://www.npmjs.com/package/should-send-same-site-none

需要明确的是，浏览器不会拒绝 cookie。相反，cookie 存储在发送响应的第 3 方域名的名称中。
由于请求和响应来自同一个域(本地主机)，因此在本地托管时它工作得很好