Heroku部署MERN栈应用生产环境接口报错、Cookie失效问题

基于MERN栈开发社交媒体应用，开发环境下所有功能运行正常。前后端部署到Heroku并绑定自定义域名https://www.universegram.fr后，生产环境出现接口请求异常，故障现象如下：

• 初始阶段登录接口返回200状态码，但用于身份校验的JWT Cookie未正常写入，用户无法保持登录状态
• 调整CORS origin配置、将Cookie的sameSite设为none、secure设为true后，接口直接返回400错误，前后端无法正常通信，暂未定位错误根因

开发环境配置 #

Server.js #

const app = express();
const PORT = process.env.PORT || 5000

const corsOptions = {
    origin: "http://localhost:3000",
    credentials: true,
    "allowedHeaders": ["sessionId", "Content-Type"],
    "exposedHeaders": ["sessionId"],
    "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
    "preflightContinue": false
}

app.use(cors(corsOptions));

app.set("trust proxy", 1);
// 读取请求体与Cookie
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: true }));
app.use(cookieParser());

// JWT校验中间件
app.get("*", checkUser);
app.get("/jwtid", requireAuth, (req, res) => {
    res.status(200).send(res.locals.user._id)
});

// 路由挂载
app.use("/api/user", userRoutes);
app.use("/api/post", PostRoutes);

// 生产环境托管静态资源
if(process.env.NODE_ENV === "production"){
    // 设置静态资源目录
    app.use(express.static("client/build"))

    app.get("*", (req, res) => {
        res.sendFile(path.resolve(__dirname, "client", "build", "index.html"))
    })

}

// 启动服务
app.listen(PORT, () => {
    console.log(`Server is running on ${process.env.PORT}`);
})

AuthController.js（SignIn登录方法） #

module.exports.signIn = async (req, res) => {
    const { email, password } = req.body;

    try {
        const user = await UserModel.login(email, password);
        const token = createToken(user._id);
        res.cookie("jwt", token, {
            maxAge: maxAge, 
            sameSite: "lax",
            // httpOnly: true,
            secure: false,
        })
        res.status(200).json({ user: user._id })

    }
    catch (err) {
        const errors = signInErrors(err);
        res.status(400).json({ errors });
    }
}

客户端package.json #

{
  "name": "client",
  "version": "0.1.0",
  "private": true,
  "homepage": "/",
  "dependencies": {
    "@testing-library/jest-dom": "^5.16.4",
    "@testing-library/react": "^13.0.1",
    "@testing-library/user-event": "^13.5.0",
    "firebase": "^9.7.0",
    "hamburger-react": "^2.5.0",
    "particlesjs": "^2.2.3",
    "react": "^18.0.0",
    "react-burger-menu": "^3.0.6",
    "react-dom": "^18.0.0",
    "react-scripts": "5.0.1",
    "sass": "^1.50.0",
    "web-vitals": "^2.1.4"
  },
  "proxy": "http://localhost:5000",
  "scripts": {
    "start": "craco start",
    "build": "craco build",
    "test": "craco test",
    "eject": "craco eject"
  },
  "eslintConfig": {
    "extends": [
      "react-app",
      "react-app/jwt"
    ]
  },
  "browserslist": {
    "production": [
      ">0.2%",
      "not dead",
      "not op_mini all"
    ],
    "development": [
      "last 1 chrome version",
      "last 1 firefox version",
      "last 1 safari version"
    ]
  },
  "devDependencies": {
    "dotenv": "^16.0.0",
    "js-cookie": "^3.0.1",
    "react-redux": "^7.2.8",
    "react-router-dom": "^6.3.0",
    "reactjs-popup": "^2.0.5",
    "redux": "^4.1.2",
    "redux-devtools-extension": "^2.13.9",
    "redux-logger": "^3.0.6",
    "redux-thunk": "^2.4.1"
  }
}

生产环境修改项 #

CORS origin配置调整 #

const corsOptions = {
    origin: "https://www.universegram.fr",
    credentials: true,
    "allowedHeaders": ["sessionId", "Content-Type"],
    "exposedHeaders": ["sessionId"],
    "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
    "preflightContinue": false
}

Cookie配置调整 #

module.exports.signIn = async (req, res) => {
    const { email, password } = req.body;

    try {
        const user = await UserModel.login(email, password);
        const token = createToken(user._id);
        res.cookie("jwt", token, {
            maxAge: maxAge, 
            sameSite: "none",
            // httpOnly: true,
            secure: true,
        })
        res.status(200).json({ user: user._id })

    }
    catch (err) {
        const errors = signInErrors(err);
        res.status(400).json({ errors });
    }
}

目前已尝试多种排查方案仍未定位问题，寻求可行的解决思路。

内容的提问来源于stack exchange，提问作者Ngc1987