The cookie doesn't allow response on production environment

The scenario is when the backend service based Koajs and Koa-session with the default configuration:

app.keys = [process.env.SESSION_SECRET];
const isProd = process.env.NODE_ENV === 'production' ? true : false;
const SESSION_CONFIG: any = {
  key: 'koa:sess',
  maxAge: 1000 * 60 * 60 * 24 * 7, // 7 days
  overwrite: true,
  httpOnly: isProd,
  signed: true,
  rolling: true,
  renew: false,
  secure: isProd,
  sameSite: 'None',
};

When the request calling to the endpoint and get an error code 500, it doesn’t respond as expected and set the cookie to the browser. But when removing secure and sameSite, it’s working but the cookie doesn’t set to the browser.

[phivh]

Thanks @dominicegginton , The solution above was helpful and we also can set domain: 'api.domain.com' in the configuration. Maybe this is also a session to learn. const SESSION_CONFIG = { key: 'koa:sess', maxAge: 1000 * 60 * 60 * 24 * 7, // 7 days overwrite: true, httpOnly: isProd, signed: true, rolling: true, renew: false, secure: isProd, sameSite: 'None', domain: 'api.anotherdomain.com', } Thanks for your help!

[hta218]

Thanks all, I already fixed the issue.

I’ll re-format the answer of @phivh to make it more readable

const isProd = process.env.NODE_ENV === 'production' ? true : false

const CONFIG = {
  key: 'koa.sess',
  maxAge: 86400000,
  autoCommit: true, 
  overwrite: true, 
  httpOnly: isProd, 
  signed: true, 
  rolling: false, 
  renew: false, 
  secure: isProd,
  sameSite: 'None',
};

app.use(koaSession(CONFIG, app));