CloudFront

Hi, I’m just trying to get my app ready for production. The app is hosted by Aws and is built like this: Route53 -> CloudFront -> ELB (no cluster, only SingleApp) CloudFront is used to make the app accessible via SSL. The Nodejs app listens on an HTTP port. Unfortunately the SessionCookie is not set. Here is my config:

session({
            genid: (req) => {
                return uuid() // use UUIDs for session IDs
            },
            secret: process.env.SESSION_SECRET,
            resave: false,
            saveUninitialized: false,        
            proxy:!dev,    
            store: new MongoStore({ mongooseConnection: mongoose.connection }),
            rolling: true,
            cookie:{
                secure:!dev,
                httpOnly:true,
                domain:hostName,
                expires: expiryDate
            }
        })

What am I doing wrong?

Thanks for your work 😃 .

[renehauck]

Finally it works! 🎉 The solution is to select “whitelist” instead of “all” under “Cache Based on Selected Request Headers”. No idea why “all” is not “all”.

Under “WhiteList-Headers” the header “cloudfront-forwarded-proto” must be in the whitelist.

Now the following middleware must be created in the Express App before the session and cookie middleware:

server.use([(req, res, next) => {
    if (req.headers['cloudfront-forwarded-proto']) {
      req.headers['x-forwarded-proto'] = req.headers['cloudfront-forwarded-proto'];
    }
    next();
  },

Many thanks for the great help @dougwilson

[dougwilson]

Please open a new issue with your information. If you believe this is a similar issue you can link to it.