Express.js中Cookie处理异常：无法成功设置Cookie

问题情况 #

我是编程新手，正在用Node.js和Express开发Web应用，现在遇到Cookie处理问题：调用res.cookie方法后，Cookie并未在浏览器中生效，后续请求也无法读取该Cookie。账户创建功能正常，但Cookie始终没加上。

相关代码 #

const express = require('express')
const cors = require('cors')
const bodyParser = require('body-parser')
const request = require('request')
const app = express()
const PouchDB = require('pouchdb');
const db = new PouchDB('accounts');
const google_url = "https://www.google.com/recaptcha/api/siteverify"
const secret_key = "x"
const jwt = require('jsonwebtoken')
const jwt_key = 'x'
const cookieParser = require('cookie-parser')
PouchDB.plugin(require('pouchdb-find'));

app.use(cookieParser());
// error messages
const invalid_name = "Please enter a valid name!"
const invalid_email = "Please enter a valid email address!"
const invalid_password = "Your password must contain 8 characters!"
const invalid_confirm = "Your password must match!"
const invalid_check = "Please accept our Terms of Use!"
const invalid_captcha = "Please complete our human verification!"
const email_used = "The email address is already in use. Please use a different email."
//

app.use(cors())
app.use(bodyParser.json())
// database
db.createIndex({
  index: { fields: ['email'], unique: true }
});
function isEmailUsed(email) {
  return new Promise((resolve, reject) => {
    db.find({
      selector: { email: email },
      fields: ['_id'],
      limit: 1
    }).then(result => {
      // If a document is found, the email is already used
      resolve(result.docs.length > 0);
    }).catch(error => {
      console.error('Error checking email:', error);
      reject(error);
    });
  });
}
async function printAllDocs() {
  try {
    const result = await db.allDocs({ include_docs: true });
    result.rows.forEach(row => {
      console.log(row.doc);
    });
  } catch (error) {
    console.error('Error fetching documents:', error);
  }
}

// Call the function to print all documents
printAllDocs();
// Sign Up handler
app.post("/createaccount",(req,res)=>{
    console.log(req.cookies.auth);
    var reqData = req.body
    const user_ip = req.ip
    const email = reqData.email
    const firstname = reqData['first-name']
    const lastname = reqData['last-name']
    const password = reqData.password
    // we need to double check client's informations.
    //checking captcha
    const captcha_data = {
      secret:secret_key,
      response:reqData.token,
      remoteip:user_ip
    }
    console.log(user_ip);
    function senderror(msg,code){
      res.status(code).json({message:msg})
    }
    request.post(
      google_url,
      {headers:{"Content-Type":"application/x-www-form-urlencoded"},body: new URLSearchParams(Object.entries(captcha_data)).toString()},
       (err,xmlres,body)=>{
        const res_captcha = JSON.parse(body)
        const is_success = res_captcha.success
        if (is_success){
          // TODO: check if the email is already used.
          isEmailUsed(email).then( (result) =>{
            if (result){
              // email is already used
              senderror(email_used,409)
            }else{
              // user is valid: create account, redirect him to that account while creating a cookie
              const user = {
                email: email,
                firstname: firstname,
                lastname: lastname,
                password: password,
                verified: false,
                creation_date: Date.now(),
                sessions: {['0']:{ip:user_ip,time:Date.now()}},
              }
              db.post(user).then((result)=>{
                // account successfully created
                const userid = result.id
                // creating a token
                const session_id = "0"
                const token = jwt.sign({session_id,userid},jwt_key)
                // account is done
                // user has to verify his account 
                // TODO: send email to user with a verification link.
                console.log('account created with success!');
                console.log(token);
                res.status(200).cookie('session-token',token,{ maxAge: 30 * 24 * 60 * 60 * 1000,httpOnly: true}).json({success:true})
              }).catch((error)=>{
                console.error(error)
                senderror("Internal error!",404)
              })
            }
          }).catch(error=>{
            console.error(error)
          })
        }else{
          // user was not valid
          senderror(invalid_captcha,401)
        }
      }
    )
})

// Sign In handler
app.listen(4202)

解决建议 #

1. 修复CORS配置 #

跨域场景下，默认的CORS配置不支持Cookie传递，需要修改cors中间件配置：

// 替换原来的app.use(cors())
app.use(cors({
  origin: 'http://localhost:你的前端端口', // 必须指定具体前端域名，不能用*
  credentials: true // 允许携带凭证（Cookie）
}))

同时前端请求时要开启凭证携带：

• 用axios：axios.post(url, data, { withCredentials: true })
• 用fetch：fetch(url, { method: 'POST', credentials: 'include', ... })

2. 完善Cookie属性设置 #

浏览器对Cookie的SameSite属性有默认限制，跨域场景下需要显式配置：

res.status(200).cookie('session-token', token, {
  maxAge: 30 * 24 * 60 * 60 * 1000,
  httpOnly: true,
  sameSite: 'None', // 跨域时必须设为None
  secure: process.env.NODE_ENV === 'production' // 生产环境必须开启secure（HTTPS下生效），本地开发可暂时设为false
}).json({success:true})

注意：本地用HTTP协议时，secure设为true会导致Cookie无法保存，需根据环境动态调整。

3. 检查请求响应顺序 #

确保res.cookie在res.json之前调用，你的代码链式调用没问题，但要避免任何提前发送响应的逻辑（比如在res.cookie前调用res.send或res.end）。

4. 替换废弃的request库 #

request库已停止维护，建议换成axios或node-fetch，虽不是Cookie问题直接原因，但能避免后续潜在问题。

内容的提问来源于stack exchange，提问作者BadlyDev