title: node express-session react : server cookies not sent to client
body: <p>Dears,</p>
  
  <p>My https client, created in React, doesn't receive the cookies created on the server (node.js app, using express-session), while calling the server graphql mutations.</p>
  
  <p>Both sides are https, server running on port 443 <a href="https://localhost:443" rel="nofollow noreferrer">https://localhost:443</a> , client on port 3000 <a href="https://localhost:3000" rel="nofollow noreferrer">https://localhost:3000</a></p>
  
  <p>When I run the graphql playground end point (<a href="https://localhost:443/graphql" rel="nofollow noreferrer">https://localhost:443/graphql</a>) , the graphql tool receives the cookies.</p>
  
  <p>But when I call the graphql mutations from the client, using apollo, the client receives the data, but not the cookie...</p>
  
  <p>Therefore I'm assuming the issue is related to the ports that are different between server and client but I tried all configurations for the cookies parameters "sameSite" and "secure".
  Whatever the combination of these 2 boolean, client never receives the cookie.</p>
  
  <p>Is there any other parameter to set ?</p>
  
  <p>Here is the node express-session code (session are stored in a redis store)</p>
  
  <p>thks.</p>
  
  <pre><code>app.use(cors({ origin: 'https://localhost:3000', credentials: true }));
  app.use(session({
      store,
      name: SESSION_NAME,
      secret: SESSION_SECRET,
      resave: false,
      saveUninitialized: false,
  
      cookie: {
          maxAge: parseInt(SESSION_LIFETIME),
          sameSite: !IN_DEV,
          secure: !IN_DEV
      },
  }));
  </code></pre>
  
  <p><strong>[EDIT - ISSUE FIXED AFTER HELP FROM Daniel Rearden]</strong></p>
  
  <p>here is the code on server side and client side to make it fix all issues.</p>
  
  <p><strong>Server side:</strong></p>
  
  <pre><code>//  generation sessions
  app.use(session({
      store,
      name: SESSION_NAME,
      secret: SESSION_SECRET,
      resave: false,
      saveUninitialized: false,
  
      cookie: {
          maxAge: parseInt(SESSION_LIFETIME),
          httpOnly: true,
          sameSite: true,
          secure: !IN_DEV,
      },
  }));
  
  app.use(cors({ origin: 'https://localhost:3000', credentials: true }));
  
  // should be added to avoid CORS issue after executing the Grahql queries
  res.setHeader("Access-Control-Allow-Origin", "https://localhost:3000");
  const apolloServer = new ApolloServer({
      typeDefs,
      resolvers,
  
      //     //  permet de tester grqphql. 
      //     //  settings permet de gerer en dev les cookies
      playground: IN_DEV ? {
          settings: { 'request.credentials': 'include' }
      } : false,
      context: ({ req, res }) =&gt; ({ req, res })
  });
  apolloServer.applyMiddleware({ app });
  </code></pre>
  
  <p><strong>client side</strong></p>
  
  <pre><code>import { ApolloClient } from 'apollo-client';
  import { createHttpLink } from 'apollo-link-http'
  import { InMemoryCache } from 'apollo-cache-inmemory'
  const link = createHttpLink({
      uri: "https://localhost/graphql",
      credentials: 'include'
  });
  
  export const apolloClient = new ApolloClient({
      link,
      cache: new InMemoryCache({ addTypename: false })
  });
  </code></pre>