Sharing data with express-session

[jcubic]

I have express-session:

app.use(session({
    secret,
    resave: true,
    genid: unique_token,
    saveUninitialized: true,
    cookie: { httpOnly: true, maxAge: 60*60*1000 },
    name: 'QS_'
}));

And I'm saving req.session.admin using in auth route:

app.post(ADMIN_LOGIN, function(req: Request, res: Response, next: NextFunction) {
    if (req.body.user === admin.name && req.body.pass == admin.pass) {
        req.session.admin = true;
        req.session.save(function (err) {
            if (err) {
                next(err);
            }
            if (is_string(req.query.next)) {
                res.url_redirect(req.query.next);
            } else {
                res.url_redirect('/admin');
            }
        });
    } else {
        res.render('pages/admin_login', { error: 'Wrong username or password!' });
    }
});

the problem is that req.session is missing my admin flag when used inside a context:

export async function create_context(
    { req }: ExpressContextFunctionArgument
): Promise<Partial<Context>> {
    const admin = req.session.admin === true;

    console.log(req.session);
    console.log(req.session.admin);

    if (!admin && !DEBUG) {
        throw new GraphQLError('User is not authenticated', {
            extensions: {
                code: 'UNAUTHENTICATED',
                http: { status: 401 },
            },
        });
    }

    return {
        prisma,
        admin
    };
};

is this a bug that the session is not persistent between the express.js route and Apollo Server API?

This is my setup of ApolloServer:

import prisma from '../prisma';

export interface Context {
    admin: boolean;
    prisma: typeof prisma;
}

export const apollo_server = (httpServer: any) => {
    return new ApolloServer<Partial<Context>>({
        schema,
        plugins: [
            ApolloServerPluginDrainHttpServer({ httpServer }),
            ApolloServerPluginLandingPageGraphQLPlayground()
        ],
        introspection: true
    });
};

export const start = async (port: number, callback: () => void) => {
    const httpServer = http.createServer(app);
    const server = apollo_server(httpServer);
    await server.start();
    app.use(
        '/api/',
        cors<cors.CorsRequest>({ origin: "*" }),
        json(),
        expressMiddleware(server, {
            context: create_context
        }),
    );
    httpServer.listen({ port }, callback);
};

The code without console.log is available on GitHub: https://github.com/jcubic/quizerach and live at https://quiz.koduj.org/api

The API is in the quiz directory you need to define .env file with proper data to use with Prisma. I can provide the reproduction but it takes time, so I'm asking before writing one, just in case this is something simple to solve.

EDIT:

I've found this issue: express-session doesn't work with expressMiddleware in apollo-server 4

but the /api returns this header:

Set-Cookie: QS_=s%3A674d1be0-d157-11ed-8fb1-9ff3a8945113.cxpgWqBw40h80Qn%2BPOJCLnMLqrgYKOqx%2BrIk2bMNEwM; Path=/; Expires=Sun, 02 Apr 2023 14:08:04 GMT; HttpOnly

The session object is there only the data in store is missing.

[jcubic]

Ok I've foud the issue by debugging the express-session. I've found that on each request new session was created because cookie was missing in the request.

Found this SO question: GraphQL playground - sending Cookie as Http Header "disappears", the problem was that in playground there was a setting:

{
  ...
  "request.credentials": "omit",
  ...
}

Changing it to:

{
  ...
  "request.credentials": "include",
  ...
}

and saving the settings solved the issue.

[DavidForDev]

[jcubic]

GitHub discussions are not a forum, this is Q&A. If you have a similar problem and ask for help, don't ask me only create another question.