I have a backend writing in Nodejs and express that i deployed to heroku that is using free dyno hours. I am using cookies to keep users logged in. But heroku is not setting my cookies in the browser. Why is that?

chukwuebuka65:
I have a backend writing in Nodejs and express that i deployed to heroku that is using free dyno hours. I am using cookies to keep users logged in. But heroku is not setting my cookies in the browser. Why is that?

did you set your config , try hosting your keys

arejibadz:
did you set your config , try hosting your keys

What keys? And what options of the config?

chukwuebuka65:


What keys? And what options of the config?

I'm sure you stored your key in your .env
You have set your whatever your key is in your .env file with Heroku
Run the following command on your cmd
heroku config:set SECRET=1992992292992929292929



Or you can just go on heroku and put it in your settings

arejibadz:

I'm sure you stored your key in your .env
You have set your whatever your key is in your .env file with Heroku
Run the following command on your cmd
heroku config:set SECRET=1992992292992929292929



Or you can just go on heroku and put it in your settings

I did that. That’s not the problem. From stackoverflow I am getting a hint about heroku load balancer terminating ssl before request reach my app. Therefore my express seeing that the connection is not over ssl refuses to set the secure attribute of the cookie. And because the samesite attribute is set to none , the browser will not save the cookie because the secure attribute is not there. I think my problem now is how to tell my express app to set the secure attribute of the cookie whether over ssl or not. Can you help with that?

chukwuebuka65:


I did that. That’s not the problem. From stackoverflow I am getting a hint about heroku load balancer terminating ssl before request reach my app. Therefore my express seeing that the connection is not over ssl refuses to set the secure attribute of the cookie. And because the samesite attribute is set to none , the browser will not save the cookie because the secure attribute is not there. I think my problem now is how to tell my express app to set the secure attribute of the cookie whether over ssl or not. Can you help with that?

If you are using cookier-parser middleware, inside the middleware, include this {secure: true, samesite:”none”}… It will solve your problem

jbreezy:

If you are using cookier-parser middleware, inside the middleware, include this {secure: true, samesite:”none”}… It will solve your problem

Still not working, I guess I will have to store the token in memory on the frontend for the meantime until I can find the solution

chukwuebuka65:
I have a backend writing in Nodejs and express that i deployed to heroku that is using free dyno hours. I am using cookies to keep users logged in. But heroku is not setting my cookies in the browser. Why is that?

next time use python and not nodeJS

chukwuebuka65:
I have a backend writing in Nodejs and express that i deployed to heroku that is using free dyno hours. I am using cookies to keep users logged in. But heroku is not setting my cookies in the browser. Why is that?

next time learn python and not nodeJS

chukwuebuka65:


Still not working, I guess I will have to store the token in memory on the frontend for the meantime until I can find the solution

if I may ask what do you use the token for authentication??

arejibadz:
if I may ask what do you use the token for authentication??

I didn’t understand, can you rephrase pls.

TastyFriedPussy:
next time use python and not nodeJS

Django is more complicated than NodeJs

jbreezy:
Django is more complicated than NodeJs

They're 2 different things tho

chukwuebuka65:


I didn’t understand, can you rephrase pls.

your using token or cookie for authentication you either use session storage or local storage in your frontend to get your tokens from the backend

arejibadz:
your using token or cookie for authentication you either use session storage or local storage in your frontend to get your tokens from the backend

Yea I know I can store the token in local storage but it is not advisable that is why I want to use httponly cookie that javascript cannot access.

arejibadz:
your using token or cookie for authentication you either use session storage or local storage in your frontend to get your tokens from the backend

I finally figured it out. It wasn’t actually heroku problem. It’s from the browser. So it happens that There is a list called “ Mozilla foundation public suffix list” which if the company hosting your app is included in the list, no browser will save any cookie from the website subdomain ( in the case of heroku , *.herokuapp.com). And I am not using a custom domain name. So thats where the problem is coming from. The solution now is to either get a custom domain name or combine my front end and backend together so they can be served by the same server.
Thanks for your help sir.

I don't think it is anything related to code. So, don't do anything with code to fix the problem. In this regard, I found a good solution on Stack Overflow, and it is about adding a static route or folder to the Express server. You can also visit this source https://devcenter.heroku.com/articles/cookies-and-herokuapp-com to get all details about Heroku and cookies.

However, if Heroku is still creating problems for you, then you should try alternatives with the free tier. Hereof, you can find a variety of Heroku alternatives here https://blog.back4app.com/top-10-heroku-alternatives/ and utilize any of them according to the need of your project. You can simply try Netlify, CapRover, Railway and Google App Engine because they come with free plans. Withal, if you have a reasonable budget, don't skip Open Shift. It provides several appealing advantages.

HassieMalcomson:
I don't think it is anything related to code. So, don't do anything with code to fix the problem. In this regard, I found a good solution on Stack Overflow, and it is about adding a static route or folder to the Express server. You can also visit this source https://devcenter.heroku.com/articles/cookies-and-herokuapp-com to get all details about Heroku and cookies.

However, if Heroku is still creating problems for you, then you should try alternatives with the free tier. Hereof, you can find a variety of Heroku alternatives here https://blog.back4app.com/top-10-heroku-alternatives/ and utilize any of them according to the need of your project. You can simply try Netlify, CapRover, Railway and Google App Engine because they come with free plans. Withal, if you have a reasonable budget, don't skip Open Shift. It provides several appealing advantages.

Ok. Thanks for the info

chukwuebuka65:


Ok. Thanks for the info

Welcome

Heroku, has recently changed its terms of free usage. If your application is on free hosting, I think you can now no longer be able to do some of these things for free. Please, check heroku's new term of usage. I may be wrong tho... but that os what I read yesterday.

TastyFriedPussy:
next time learn python and not nodeJS

You evidently have not gotten to the section on cookies and jwt in your tutorials.