I am running a node.js with working Passport.js "local", "facebook" and "google" authentication. I use express-session with MongoDB as store, everything works like a charm : session is persisted upon successful authentication, cookie in the browser, sent by axios and session is recovered as I come back.
If however I move to https, my session cannot be recovered. I can login, see my session in the mongoDB, see my cookie in the browser, but the session is not pulled and nothing is in req.user.
My code looks pretty much "common" for what I can read on the web, cannot see anything obviously different of missing :
const dotenv = require('dotenv');const express = require('express');const app = express();const https = require('https');var fs = require('fs');const cors = require('cors');const session = require("express-session");const bodyParser = require("body-parser");const passport = require('./passport/passport');const authRoutes = require('./routes/auth');const userRoutes = require('./routes/user');const ensureAuthenticated = require('./middlewares/auth/ensureAuthenticated');const ensureAuthorized = require('./middlewares/auth/ensureAuthorized');const connectMongoDb = require('./mongoDb/connectMongoDb');const mongoose = require("mongoose");const MongoStore = require('connect-mongo')(session);dotenv.config();connectMongoDb();app.use(bodyParser.json());app.use(bodyParser.urlencoded({ extended: true }));app.use(cors({ origin: `${process.env.CLIENT_HOST_URI}:${process.env.CLIENT_PORT}`, credentials: true}));app.use(session({ secret: process.env.SESSION_COOKIE_SECRET, resave: false, saveUninitialized: false, store: new MongoStore({ mongooseConnection: mongoose.connection }), cookie: { maxAge: 24 * 60 * 60 * 1000 }}));app.use(passport.initialize());app.use(passport.session());app.use('/api/auth', authRoutes);app.use('/api/user', ensureAuthenticated, userRoutes);https .createServer({ key: fs.readFileSync('server.key'), cert: fs.readFileSync('server.cert') }, app) .listen(process.env.API_SERVER_PORT, () => { console.log(`Server has started on port ${process.env.API_SERVER_PORT} over HTTPS`); });I suspect this might be linked to the self-signed certificate I am using. But... I cannot believe I should deploy and get a real certificate to get this work on my laptop in dev mode.
I also wonder if there is any log that could tell me what goes wrong.
Thank you for you help,David