Use distinct session settings based on req domain

[ortizvinicius]

Hello guys,

I have a web application that runs on localhost serving data through the port :30 to an also local web interface accessed via IP. Then, i set up a ngrok tunnel to redirect the server data through ssh to an online address accessed via an online web interface.

the 2 interfaces are identical, the only difference is that if the user is outside the network, then he can access the system through the online interface. I need this to work that way, cause i can not be 100% dependant on internet connection for my app to work, so if the user doesn't have internet but are in the local network, he can access the local address.

This is working fine for a couple of years, but since some time I started to experience in iOS, where after the login, the page returned to the login page, as the session was not started. It only works fine on Opera for iOS. In Android and Windows it works well in any navigator, but now Google Chrome started to show this message for the online interface:

A cookie associated with a cross-site resource at http://***.ngrok.io/ was set without the SameSite attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with SameSite=None and Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

Currently my session setting is this:

exapp.use(session({ 
  name: 'session-name',
  secret: 'session-secret',
  resave: false,
  saveUninitialized: false,
  rolling: true,
  cookie: {
    secure: false,
    httpOnly: false
  }
}));

I can solve the problem by setting it like this:

exapp.set('trust proxy', 1);
exapp.use(session({
  name: 'session-name',
  secret: 'session-secret',
  resave: false,
  saveUninitialized: false,
  rolling: true,
  cookie: {
    sameSite: 'none',
    secure: true,
    httpOnly: false
  }
}));

But then i fall in another problem: the local interface. It doesn't work anymore because the local address is not HTTPS and even if i install a certificate i need to trust this in every navigator that will use the app.

My question is: Is there a way to use 2 types of settings for the express session? One for the remote interface which will be secure and cross-domain, and another for the local interface which will be on the same domain and insecure. If not, then a alternative suggestion will be welcome.

Thanks.

[dougwilson]

Maybe just use secure: 'auto' setting?

[dougwilson]

As for the generic question, there is a way, but I'm not at a computer at the moment to write up examples, so figured maybe the above would at least unblock you.

[ortizvinicius]

Hi @dougwilson , thanks for the answer, but the 'auto' value is invalid as the 'cookie' package doesn't have support to it.

[dougwilson]

but the 'auto' value is invalid as the 'cookie' package doesn't have support to it.

Please excuse me if I'm misunderstanding your post, but I believe you're talking about the express-session module configuration, right? It is supposed by express-sesion https://github.com/expressjs/session/blob/master/README.md#cookiesecure

The cookie.secure option can also be set to the special value 'auto' to have this setting automatically match the determined security of the connection.

Does the setting not work for you? What error are you getting when you try and use it?

[ortizvinicius]

Sorry man, i had put the auto setting inside SameSite instead of secure.

Now in the right place it works, but I receive the Chrome message at the local address:

A cookie associated with a resource at http://192.168.1.58/ was set with SameSite=None but without Secure. A future release of Chrome will only deliver cookies marked SameSite=None if they are also marked Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5633521622188032.

[dougwilson]

Right, because Chrome is planning to not allow samesite none without also setting secure. If your site requires the use of samesite non you cannot serve the site over http in Chrome.

[ortizvinicius]

Do you think something like cookie.sameSite = 'auto' would be possible?

[dougwilson]

Unlike secure, the samesite setting actually can break how one's site works. As in if you need samesite none, it is unlikely you can then use a different samesite setting, as otherwise you should always use the most strict samesite setting your site can.

[ortizvinicius]

So, I think in my case the best solution is to have 2 express instances, right? One for local request and other for remote.

[ortizvinicius]

As a "sameSite=auto" which tests if the "origin == host" (or something like that) would not be safe

[dougwilson]

You can certainly do that, or if the only difference is the express-session config, you can just have two instances of that and choose between the two. Writing up an example is difficult on a phone, so I'll need to be at a computer if you want to see an example.

[ortizvinicius]

Yes, the only thing that will change is the session config, how can I change between each one as the app is running?

[HarshithaKP]

@ortizvinicius I have written a program demonstrating how to change between different session types when the app is running.
You can find the program here : https://gist.github.com/HarshithaKP/87b1258d6476d2e3f311ae502a3f6d66
Let me know if it helps in resolving your issue

[ortizvinicius]

Hi @HarshithaKP Thank You! I will take a look and get back here asap, happy new year!