Nest.js设置的Refresh Token Cookie在Next.js页面刷新/关闭后无法持久化的问题求助

大家好，我遇到一个头疼的问题：用户登录后，我的Nest.js后端会把refresh token作为Cookie返回，但这个Cookie在Next.js页面刷新或者关闭后就消失了，导致后续无法调用refresh接口获取新的access token。

我是在服务器端设置的这个refresh token Cookie，本以为配置是安全有效的，但就是没法持久化。下面是我的相关代码和配置，麻烦各位帮忙看看哪里出问题了🙏

后端Nest.js的登录与刷新接口逻辑 #

@Post('/login')
@UsePipes(new ZodValidationPipe(authenticateBodySchema))
async login(
  @Body() body: AuthenticateBodySchema,
  @Res({ passthrough: true }) response: Response,
) {
  const { email, password } = body

  const user = await this.authService.validateUser(email, password)

  const { senha, ...userWithoutPassword } = user

  const token = this.authService.generateAccessToken(user.id)

  const refreshToken = this.authService.generateRefreshToken(user.id)

  response.cookie('refreshToken', refreshToken, {
    path: '/',
    httpOnly: true,
    secure: this.configService.getOrThrow('ENVIRONMENT') === 'PRODUCTION',
    sameSite: true,
    maxAge: 7 * 24 * 60 * 60 * 1000,
  })

  return { token, user: userWithoutPassword }
}

@Post('/refresh')
async refresh(
  @Req() request: Request,
  @Res({ passthrough: true }) response: Response,
) {
  const refreshToken = request.cookies.refreshToken

  const { sub, user } =
    await this.authService.validateRefreshToken(refreshToken)

  const generatedAccessToken = this.authService.generateAccessToken(sub)

  const generatedRefreshToken = this.authService.generateRefreshToken(sub)

  const { senha, ...userWithoutPassword } = user

  response.cookie('refreshToken', generatedRefreshToken, {
    path: '/',
    httpOnly: true,
    secure: this.configService.getOrThrow('ENVIRONMENT') === 'PRODUCTION',
    sameSite: false,
    maxAge: 7 * 24 * 60 * 60 * 1000,
  })

  return { token: generatedAccessToken, user: userWithoutPassword }
}

Nest.js主文件（Main.js）配置 #

import { NestFactory } from '@nestjs/core'
import { AppModule } from './app.module'
import { ConfigService } from '@nestjs/config'
import { Env } from './env'
import * as cookieParser from 'cookie-parser'

async function bootstrap() {
  const app = await NestFactory.create(AppModule, {
    cors: {
      origin: ['http://localhost:3001', 'https://mywebsite.vercel.app'],
      credentials: true,
    },
  })

  app.use(cookieParser())

  const configService: ConfigService<Env, true> = app.get(ConfigService)

  const port = configService.get('PORT', { infer: true })

  await app.listen(port)
}
bootstrap()

前端Next.js的登录逻辑 #

const signIn = async (email: string, password: string) => {
  const response = await AuthService.login(email, password)

  const decodedToken = jwtDecode(response.token)

  if (!decodedToken.exp) {
    toast('Erro ao fazer login')
    return
  }

  destroyCookie(undefined, 'mywebsite-token')

  const tokenExpiration = (decodedToken?.exp * 1000 - Date.now()) / 1000

  setCookie(undefined, 'mywebsite-token', response.token, {
    maxAge: tokenExpiration,
  })

  http.defaults.headers.Authorization = `Bearer ${response.token}`

  setUser(response.user)

  router.replace('/receitas')
}

现象说明 #

登录成功后，我能在浏览器的开发者工具里看到后端返回的refreshToken Cookie，但是一旦刷新页面或者关闭浏览器重新打开，这个refreshToken就不见了，导致无法调用refresh接口更新access token。

备注：内容来源于stack exchange，提问作者Nilton Schumacher F