MERN应用部署后登录报错：TypeError: Cannot read property 'id' of undefined

问题背景 #

我正在部署一款基于MERN栈的应用：后端托管在Railway，前端托管在Vercel，采用Google OAuth 2.0实现身份验证，会话存储依赖express-sessions和connect-mongo。本地运行完全正常，但部署完成后尝试登录会直接跳回登录页，同时Railway日志抛出如下错误：

TypeError: Cannot read property 'id' of undefined
at dashboard (/server/controllers/index.js:11:63)
at Layer.handle [as handle_request] (/server/node_modules/express/lib/router/layer.js:95:5)
at next (/server/node_modules/express/lib/router/route.js:144:13)
at Route.dispatch (/server/node_modules/express/lib/router/route.js:114:3)
at Layer.handle [as handle_request] (/server/node_modules/express/lib/router/layer.js:95:5)
at /server/node_modules/express/lib/router/index.js:284:15
at Function.process_params (/server/node_modules/express/lib/router/index.js:346:12)
at next (/server/node_modules/express/lib/router/index.js:280:10)
at Function.handle (/server/node_modules/express/lib/router/index.js:175:3)
at router (/server/node_modules/express/lib/router/index.js:47:12)

我判断是req.user未定义导致id属性读取失败，推测问题出在express-sessions或connect-mongo的配置上——按预期这两个包应该在认证流程中给req对象添加带id属性的user字段，但我对它们的工作机制理解不够深入，没法定位具体问题。

相关代码 #

server.js #

const express = require("express");
const app = express();
const path = require("path");
const connectDB = require("./config/db");
const mongoose = require("mongoose");
const dotenv = require("dotenv");
require("dotenv").config();
const PORT = process.env.PORT || 8080;
const passport = require("passport");
const session = require("express-session");
const MongoStore = require("connect-mongo");
const cors = require("cors");
const flash = require("connect-flash");

//suppress mongoose deprecation warning
mongoose.set("strictQuery", true);

//Body parser config
app.use(express.urlencoded({ extended: false }));
app.use(express.json());

app.use(
  cors({
    origin: [
      process.env.HOST_NAME,
      process.env.PREVIEW_HOST,      
    ],
    credentials: true,
  })
);

//database connection
connectDB();

//passport Config
require("./config/passport")(passport);

//sessions
app.use(
  session({
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    store: MongoStore.create({
      mongoUrl: process.env.MONGO_URI,
      collectionName: "sessions",
    }),
    cookie: {
      secure: true,
      sameSite: "none",
      maxAge: 60 * 60 * 24 * 1000,
    },
  })
);

//passport middleware
app.use(passport.initialize());
app.use(passport.session());

//routes
app.use("/auth", require("./routes/auth"));
app.use("/", require("./routes/index"));
app.use("/words", require("./routes/words"));
app.use("/materials", require("./routes/materials"));
app.use("/api", require("./routes/api"));

app.listen(PORT, () => {
  console.log(`Server running on Port ${PORT}`);
});

controllers/index.js #

const User = require("../models/User");
const Materials = require("../models/Materials");

module.exports = {
  getIndex: (req, res) => {
    res.send("Welcome");
  },
  dashboard: async (req, res) => {
    console.log(req.user);
    try {
      const materials = await Materials.find({ user: req.user.id })
        .limit(4)
        .sort({ createdAt: -1 });
      const words = await User.find({ _id: req.user.id }, { wordList: 1 });
      res.json({ materials, words });
    } catch (err) {
      console.error(err);

      res.json({ error: "Server Error" });
    }
  },
};

额外异常 #

Firefox控制台还反复弹出如下警告，我已经尝试把express-sessions的cookie配置里的sameSite设为'none'，但问题没有解决：

Cookie “SIDCC” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it.

内容的提问来源于stack exchange，提问作者JaredCaprio