Express.js后端API Session ID未设置问题排查求助

问题场景 #

调用/provision接口时，后端能成功生成并设置req.session.id，返回status: "ok"；但后续调用/query接口时，后端检测不到req.session.id，返回错误：

{
    "error": "Session ID is missing"
}

相关代码 #

主入口文件 #

const express = require("express");
require("express-async-errors");
const cors = require("cors");
const cookieSession = require("cookie-session");
const createTables = require("./queries/create-tables");
const keys = require("./keys");
const cleanup = require("./queries/cleanup");

const app = express();

app.set("trust proxy", "127.0.0.1");
app.use(
  cors({
    origin:
      process.env.NODE_ENV === "production"
        ? ["<some-domain>", "<some-domain>"]
        : ["http://localhost:3000"],
    credentials: true,
  })
);
app.use(express.json());
app.use(
  cookieSession({
    secure: process.env.NODE_ENV === "production",
    keys: [keys.cookieKey],
    sameSite: "Lax",
    httpOnly: true,
    domain: "<some-domain>",
  })
);

app.use((req, res, next) => {
  console.log("Session:", req.session);
  if (!req.session) {
    return next(new Error("Session is not set up properly"));
  }
  next();
});

app.post("/provision", require("./provision"));
app.post("/query", require("./query"));
app.post("/reset", require("./reset"));

/provision接口逻辑 #

const pool = require("./pool");
const createRole = require("./queries/create-role");
const createDb = require("./queries/create-db");
const { createId, validateId } = require("./queries/id");

module.exports = async (req, res) => {
  let id = req.session.id;

  if (!id) {
    id = createId(8);
    req.session.id = id;
  }

  validateId(id);

  try {
    await createRole(id);
    await createDb(id);

    res.send({ status: "ok" });
  } catch (err) {
    console.error(err);
    throw new Error("Failed to provision db");
  }
};

/query接口逻辑 #

const createClient = require("./queries/create-client");
const { validateId } = require("./queries/id");
const dbExists = require("./queries/db-exists");
const touchLogin = require("./queries/touch-login");

module.exports = async (req, res) => {
  const { id } = req.session;

  console.log("Session:", id);
  if (!id) {
    return res.status(400).json({ error: "Session ID is missing" });
  }
  validateId(id);

  if (!(await dbExists(id))) {
    throw new Error("No database found. Reload this page.");
  }
  await touchLogin(id);

  const client = await createClient(id);

  try {
    console.log("Query:", req.body.query);
    const result = await client.query(req.body.query);

    if (Array.isArray(result)) {
      res.send(
        result.map(({ rows, fields, command, rowCount }) => ({
          command,
          rows,
          fields,
          rowCount,
        }))
      );
    } else {
      res.send([
        {
          command: result.command,
          rows: result.rows,
          fields: result.fields,
          rowCount: result.rowCount,
        },
      ]);
    }
  } catch (err) {
    console.error("Query Execution Error:", err);
    res.status(500).json({ error: err.message });
  } finally {
    await client.end();
  }
};

排查与解决方法 #

1. Cookie域名配置不匹配 #

cookieSession中硬编码的domain: "<some-domain>"在本地开发环境（localhost）下无效，浏览器会拒绝保存该Cookie。需根据环境动态设置域名：

app.use(
  cookieSession({
    secure: process.env.NODE_ENV === "production",
    keys: [keys.cookieKey],
    sameSite: "Lax",
    httpOnly: true,
    // 生产环境设置域名，开发环境不设置
    domain: process.env.NODE_ENV === "production" ? "<some-domain>" : undefined,
  })
);

2. Postman未正确携带Cookie #

Postman默认不会自动保存和携带Cookie，需手动处理：

• 在/query请求的"Headers"中添加Cookie字段，值为/provision接口返回的Session Cookie；
• 或开启Postman的"Settings" -> "Cookies" -> "Send cookies"选项，让工具自动管理会话Cookie。

3. Trust Proxy配置问题 #

本地开发环境如果没有使用反向代理（如Nginx），app.set("trust proxy", "127.0.0.1")可能导致Express无法正确识别Cookie来源。可以改为：

app.set("trust proxy", true);

或直接注释掉该配置，测试是否恢复正常。

4. 确认Session修改被正确标记 #

cookie-session会自动检测req.session的修改并更新Cookie，但要避免直接覆盖整个session对象。确保仅单独赋值req.session.id = id，而非req.session = { id: xxx }，防止丢失原有会话数据。

内容的提问来源于stack exchange，提问作者Daniel