ExpressJS中access_token过期后更新无法被isAuthenticated读取

我在ExpressJS中使用JWT实现认证，后端通过res.cookie向前端设置令牌，用Postman测试API。每次调用API时会先执行updateAccessToken中间件，生成新的access_token和refresh_token并设置到cookie中。access_token有效期内请求一切正常，但当access_token过期后调用API，isAuthenticated中间件无法读取到access_token。

路由配置中updateAccessToken在isAuthenticated之前执行，updateAccessToken内已成功设置新的cookie，但isAuthenticated读取req.cookies时找不到access_token。Postman中请求响应后能看到新的access_token，但cookie顺序异常。此前使用Redis存储，现在改用MongoDB，期望isAuthenticated能正常读取更新后的access_token。

路由代码（Route.ts） #

const BlogRoute = express.Router();

BlogRoute.route("/blog/all-blogs").get(getAllBlogPosts);

BlogRoute.route("/blog/single/:blogID")
    .get(getSingleBlogPost)
    .put(
        updateAccessToken,
        isAuthenticated,
        authorizeRoles("admin"),
        multerUploads.array("files"),
        updateBlogPost
    )

updateAccessToken中间件 #

export const updateAccessToken = CatchAsyncError(
    async (req: Request, res: Response, next: NextFunction) => {
        const { refresh_token } = req.cookies;
        console.log("updateAccessToken: Received cookies", req.cookies);

        if (!refresh_token) {
            return next(new ErrorHandler("Refresh token is missing", 401));
        }

        try {
            const decoded = jwt.verify(
                refresh_token,
                process.env.REFRESH_TOKEN_SECRET as string
            ) as JwtPayload;

            const user = await UserModel.findById(decoded._id);

            if (!user) {
                return next(new ErrorHandler("User not found", 404));
            }

            const newAccessToken = user.signAccessToken();
            const newRefreshToken = user.signRefreshToken();

            res.cookie("access_token", newAccessToken, accessTokenOptions);
            res.cookie("refresh_token", newRefreshToken, refreshTokenOptions);
            console.log("updateAccessToken: New tokens set");

            req.user = user;
        } catch (error) {
            return next(new ErrorHandler("Invalid refresh token", 401));
        }

        next();
    }
);

isAuthenticated中间件 #

export const isAuthenticated = CatchAsyncError(
    async (req: Request, res: Response, next: NextFunction) => {
        const { access_token } = req.cookies;
        console.log("isAuthenticated: Received cookies", req.cookies);

        if (!access_token) {
            return next(
                new ErrorHandler("Please login to access this resource", 400)
            );
        }

        try {
            const decoded: any = jwt.verify(
                access_token,
                process.env.ACCESS_TOKEN_SECRET as string
            );

            if (!decoded) {
                return next(new ErrorHandler("Invalid access_token", 400));
            }

            const user = await UserModel.findById(decoded._id);

            if (!user) {
                return next(new ErrorHandler("User not found", 404));
            }

            (req as any).user = user;
        } catch (error) {
            return next(
                new ErrorHandler("IsAuthenticated Error in Auth.ts", 400)
            );
        }

        next();
    }
);

内容的提问来源于stack exchange，提问作者Sayedul Karim