Using Express and Node, how to maintain a Session across subdomains/hostheaders

by

First of all to allow browser to make cross-domain requests you need to set headers on server side. This solution works for normal request as well as AJAX.
In your express configure function:

Express 4.0:

var express = require('express');
var session = require('express-session');
var cookieParser = require('cookie-parser');

var app = express();

app.use(cookieParser());
app.use(session({
    secret: 'yoursecret',
    cookie: {
        path: "https://stackoverflow.com/",
        domain: 'yourdomain.com',
        maxAge: 1000 * 60 * 24 // 24 hours
    }
}));
app.use(function(req, res, next) {
    res.header('Access-Control-Allow-Credentials', true);
    res.header('Access-Control-Allow-Origin', req.headers.origin);
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
    res.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept');
    next();
});

Access-Control-Allow-Origin can be set to ‘*’ if no cross-domain cookies exchange for sessions needed.
To have cookies and session shared cross-domain you need to set specific Access-Control-Allow-Origin to actually domain where request is made from, that’s why req.headers.origin – is perfect for that.

Using domain it wont work well on localhost – so make sure you disable it in development environment, and enable on production. It will enable shared cookies across top and sub domains.

This is not all.
Browsers it self won’t send cookies over cross domain requests, and this have to be forced.
In jQuery you can add extra parameter in $.ajax() request:

xhrFields: { withCredentials: true }

For non jQuery, just have XHR constructor and set this parameter:

xhr.withCredentials = true;

And you are ready to do cross-domain with shared session.

More Related Contents:

  1. ‘session’ is undefined when using express / redis for session store
  2. How to share sessions with Socket.IO 1.x and Express 4.x?
  3. socket.io and session?
  4. How do sessions work in Express.js with Node.js?
  5. How to send flash messages in Express 4.0?
  6. socket.io and express 4 sessions
  7. ExpressJS & Websocket & session sharing
  8. Sessions won’t save in Node.js without req.session.save()
  9. collection is not defined in mongodb
  10. How to access POST form fields in Express
  11. Express.js req.body undefined
  12. Cannot overwrite model once compiled Mongoose
  13. Rest with Express.js nested router
  14. What is NODE_ENV and how to use it in Express?
  15. How to get all registered routes in Express?
  16. Purpose of installing Twitter Bootstrap through npm?
  17. TypeError: db.collection is not a function
  18. Error: No default engine was specified and no extension was provided
  19. Express command not found
  20. How do I move files in node.js?
  21. node.js http.get hangs after 5 requests to remote site
  22. Express res.sendfile throwing forbidden error
  23. res.sendfile in Node Express with passing data along
  24. What are “signed” cookies in connect/expressjs?
  25. Node.js, can’t open files. Error: ENOENT, stat ‘./path/to/file’
  26. Calling Express Route internally from inside NodeJS
  27. Why POST redirects to GET and PUT redirects to PUT?
  28. Why can’t we do multiple response.send in Express.js?
  29. node.js, express, how to get data from body form-data in post request
  30. How to store a file with file extension with multer?

Leave a Comment