request session not persistent - express-session

Question

I'm trying to have a session containing user data in the node.js/express FW. I'm using express-session. I'm not using session store yet. I have 2 pages in the client (angular) where I iterate between - Login and Dashboard. The idea is to create the session after successful login, then routing to the dashboard page. In the dashboard page I have an anchor with routinlink to the login:

<a [routerLink]="['/login']" >BackToLogin</a>  

When navigating back to the loginPage (when activating a route), I execute a service with an end-point to the express server which check if the request has a session with a request in it (I expect it to be). The problem is that I see that the session is not the same session (the id changes)

See my code: Node.js side - server.js file:

const express = require('express');
const app = express();
const bodyParser = require('body-parser');
const cors = require('cors');

const session = require ('express-session'); 
var cookieParser = require('cookie-parser');
const SESS_NAME = 'sid'; 

app.use(session({
    name:SESS_NAME,
    key: 'user_sid',
    resave:false, 
    saveUninitialized:false, 
    secure: process.env.NODE_ENV ==="production",  
    secret:'<some random text>', 
    cookie:{

            httpOnly: true, 
            secure: process.env.NODE_ENV ==="production", 
            expires: 60000 
           }
}));

app.use(bodyParser.text());
app.use(bodyParser); 
app.use(bodyParser.urlencoded({ 
    extended: true
}));

app.use(cors()); //No limitation for test reasons

app.use(cookieParser());

//disabled on purpose
//var sessionManagement = require('./middleware/sessionManagement'); 
// API   
app.use("/", require("./api/v1/routes.js"))//This file includes:
/*
const express = require('express');
const router = express.Router();
router.use("/login", require('./login'));
router.use("/session", require('./session'));
module.exports = router;
*/
...etc
app.listen(config.port, () => console.log(`Process ${process.pid}: Listening on port ${config.port}`));

login.js on the server: responsible for validating user and store user data in session:

const express = require('express');
const router = express.Router();
const schema = require('./objectSchemaJson.schema.json');
const scehmaCheck = require('../../middleware/checkForSchema')(schema);//this is 
a schema check (middleware) - if suceeded continue (next)

const storeSession = (req, dataResult) =>
{
    if (<dataResult return with valid use data>) //This is "where the magic happanes"
    {
        req.session.user = { 
            username: <get userName from dataResult>, 
            ID: <Get ID from dataResult>, 
            Role: <Get Role from dataResult> 
        }    
    }
}
router.use("/", scehmaCheck, (req, res, next) => {
    return GetUserDataFROmDB(req.body).then((dataResult) => { //reaching the DB - not mentioned here on purpose
        storeSession(req, dataResult); // This is where the session set with user data
        res.status(200).json(dataResult);
    }).catch((err) => {
        next({
            details: err
        })
    });
});

module.exports = router;

This is the end point on the server that responsible for getting the session - session.js - This is where the problem appears - the res.session has a session ID which is different that the one I created after the login

const express = require('express');
const router = express.Router();

 hasSession : function(req, res) //This is where the problem appears - the res.session has a session ID which is different that the one I created after the login
{
    if (req.session.user)
    {
        res.status(200).json(
            {
                recordsets: [{Roles: req.session.Roles, UserName: req.session.user.username}]
            });
    }
    else{
        res.status(200).json({});
    }
}

router.use("/", (req, res, next) => { return sessionManagement.hasSession(req, res, next)});

module.exports = router;

Client side:

//HTML:
<div>
  <label>Username:</label>
  <input type="text" name="username" [(ngModel)]="userName" />
</div>
<div>
  <label>Password:</label>
  <input type="password" name="password" [(ngModel)]="password"/>
</div>
<div>
  <button (click)="login()">Login</button>
</div>

//COMPONENT:

login()
  {
    this.srv.login(this.userName, this.password).subscribe(result => 
      {
        if (<result is valid>)
        {
          this.router.navigate(['/dashboard']);
        } 

      }
    );
  }

//This reach the node.js endpoint and routing to the session.js end point - it is executes when the router-outlet activated in the app.component:
/*
    onActivate(componentRef : any)
      {
        if (componentRef instanceof LoginComponent)
        {
          componentRef.getSession();
        }
      }
*/



getSession() : void
  {
    this.sessionService.getSession().subscribe( result => 
      {
        if (<result is valid>)
        {
          this.router.navigate(['/dashboard']);
        }
      });
  } 

I found a similar question on github - no solution yet: https://github.com/expressjs/session/issues/515 but it might be a cookie <-> server configuration issue.

Answer 1

Found the problem - the root cause was that the client didn't send a cookie when making an httprequest. 2 things needed to be done in order to solve the problem:

1. CORS Definition

Set the CORS definition to creadentials: true along with the origin (the host name of the client, which is probably with a different port\hostname):

app.use(cors({ 
    origin: config.origin,
    credentials: true
}));

2. Set crendentials

For every http rest method (get and post, in my case) add withCredentials property with a value of true:

return this.http.get<any>(<path>, { withCredentials: true })

or

return this.http.post<any>(<path>, <body>, { withCredentials:true })