I'm encountering an issue where, even after setting a Firebase session cookie, I face difficulty accessing it in a secure endpoint due to the fact that req doesn't retrieve the cookie.
Following the instructions outlined in a Firebase tutorial titled Manage Session Cookies, I'm trying to create a cookie after a user logs in using the
Firebase signInWithEmailAndPasswordidToken of the user is then passed to a POST request:
Initially, I create a token and send it to an endpoint:
function signIn() {
var email = document.getElementById('email').value;
var password = document.getElementById('password').value;
firebase.auth().signInWithEmailAndPassword(email, password).catch(function(error) {
var errorCode = error.code;
var errorMessage = error.message;
if (errorCode === 'auth/wrong-password') {
alert('Wrong password.');
} else {
alert(errorMessage);
}
document.getElementById('quickstart-sign-in').disabled = false;
}).then(user => {
// Retrieving the user's ID token as it is required to retrieve a session cookie.
return user.getIdToken().then(idToken => {
if (firebase.auth().currentUser) {
$.ajax({
method: 'POST',
url: '/login',
data: {'email':firebase.auth().currentUser.email,idToken},
success: function(data) {
//perform other tasks...
}
});
}
});
})
}
The URL endpoint retrieves the idToken from the previous POST request, generates a session cookie using createSessionCookie, and then sets the cookie with
res.cookie('session', sessionCookie, options)exports.postLogin = (req, res, next) => {
// Retrieving the passed ID token
const idToken = req.body.idToken.toString();
// Setting session expiration to 14 days.
const expiresIn = 60 * 60 * 24 * 14 * 1000;
var exampleDB = admin.database().ref('exampleDB');
exampleDB.once('value', function(snapshot) {
//performing unrelated actions...
//generating random data...
}).then(function() {
admin.auth().createSessionCookie(idToken, {expiresIn})
.then((sessionCookie) => {
// Setting cookie policy for session cookie.
const options = {maxAge: expiresIn, httpOnly: true, secure: true};
res.cookie('session', sessionCookie, options);
res.status(200).send(randomData).end();
}, error => {
res.status(401).send('UNAUTHORIZED REQUEST!');
});
});
};
The issue arises when I navigate to another endpoint, /dashboard. The cookie that I set cannot be located, resulting in an error message indicating
TypeError: Cannot read property 'session' of undefinedexports.dashboard = (req, res, next) => {
const sessionCookie = req.cookies.session || '';
// a bunch of other code surrounding the session cookie that remains unused due to the absence of req.cookies.session
}
Am I retrieving the cookie incorrectly? Have I not set the cookie correctly? Or is the cookie not being carried over to this new endpoint, /dashboard, from the page where the POST to /login occurs?
Upon logging the req to /dashboard, I observe the following information, but I'm unsure if it's from a different session or source. If it is related to Firebase, I'm unsure of the correct method to access it:
sessionID: 'ublahxARQVljyGRblahPQrei',
session:
Session {
cookie:
{ path: '/',
_expires: null,
originalMaxAge: null,
httpOnly: true },
returnTo: '/dashboard',
flash: {},
_csrfSecret: 'r46blahE+kOzblah5==' },