Question

我在我的节点应用中遇到奇怪的问题。它托管在Heroku上，我使用存储在由我的快速中间件验证的cookie中的JSON Web令牌。当我登录Macbook pro时，cookie已成功存储。但是，当我使用Linux Mint桌面或Android平板电脑时，该站点会登录，但随后会在受保护的路由上重定向，并且cookie永远不会设置。

这是在登录时设置cookie的地方：

let token = jwt.sign({
    username: user.username,
    email: user.email
}, config.privateKey, {
   expiresIn: '7d'
});
let userResponse = {
    success: true,
    message: 'Successfully logged in!',
    id: user._id,
    email: user.email,
    username: user.username
}
    // set cookie for 7 days
res.cookie('auth_token', 
            token, 
           {maxAge: 604800000, path: "/"}).json(userResponse);

这是我的server.js文件：

'use strict';

const express = require('express');
const app = express();
const bodyParser = require('body-parser');
const env = process.env.NODE_ENV || "development";
const mongoose = require('mongoose');
const cookieParser = require('cookie-parser');
const config = require('./app/config/config.js');
process.env.PWD = process.cwd();

// Establish connection with MongoDB
mongoose.connect(config.db.connectString);

app.use(cookieParser());

// Allowing X-domain request
var allowCrossDomain = function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "*");
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Cache-Control");

    // intercept OPTIONS method
    if ('OPTIONS' == req.method) {
      res.send(200);
    }
    else {
      next();
    }
};
app.use(allowCrossDomain);

app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());

app.use(express.static('public'));

const db = mongoose.connection;
db.on('error', console.error.bind(console, 'connection error: '));
db.once('open', () => {
  console.log('Connected to sondage database');
});

// ===== Import Routers ======
const userRouter = require('./app/routes/user.routes')(express, app);
const pollRouter = require('./app/routes/poll.routes')(express, app);
const authRouter = require('./app/routes/auth.routes')(express, app);
app.use('/api/users', userRouter);
app.use('/api/polls', pollRouter);
app.use('/api/', authRouter);

// For all other requests, use React Router
app.get('*', function (request, response){
  response.sendFile(process.env.PWD + '/public/index.html');
});

app.listen(process.env.PORT || 3000, () => {
  console.log('Server running');
});

编辑我已经将其追溯到http vs https问题。如果我在请求中使用https，则cookie可以正常工作。否则不设置cookie。所以我需要一种强制用户进行HTTPS的方法。

Answer 1

我能够使用heroku-ssl-redirect节点包解决这个问题。这会接受请求并强制浏览器为每个请求使用https。

无法访问Heroku中的http访问cookie仅https

1 个答案: