I am working on a Web Application using NodeJs, Express Framework, and Firebase. After authenticating using firebase functions on the client, the idToken is sent to the server where a session cookie is created then stored in the cookies. However, res.cookie fails to store the cookie on the client.
Client-side auth.js snippets (all 2 belong to the same js client-side file)
//Log-in event start
$( "#log-form" ).submit(function( event ) {
event.preventDefault();
var email = document.getElementById('emailInput').value;
var password = document.getElementById('passwordInput').value;
firebase.auth().signInWithEmailAndPassword(email,password)
.catch(function(error) {
var errorCode = error.code;
var errorMessage = error.message;
window.alert(errorMessage);
})
.then(function(value) {
firebase.auth().currentUser.getIdToken(true)
.then(function(idToken) {
sendToken(idToken);
})
.catch(function(error) {
console.log(error.message);
});
});
});//end of log-in event
function sendToken(token)
{
$.ajax({
type: 'POST',
url: '/users/authIn',
data: {
'token' : token
},
success: function(data){
console.log(data);
},
error: function(errMsg)
{
console.log(errMsg);
}
});
}
Server-side routes/users.js code snippet
router.post('/authIn', function (req, res, next) {
var token = req.body.token.toString();
var expiresIn=1000*60*60*24;
admin.auth().verifyIdToken(token)
.then(function(decodedToken){
firebase.auth().createSessionCookie(token,{expiresIn})
.then(function(sessionCookie)
{
res.cookie('session', sessionCookie);
res.send("done");
})
.catch(function(error)
{
res.send(error);
});
res.redirect('/interfacePage');
})//end of .then
.catch(function(error){
res.send(error);
})
});
I have been trying to make this works for a couple of days now to no avail. Any assistance would be greatly appreciated.And if your answer isnt just a fix but a work around, please include code as I am fairly new to ajax/express and mightn't be familiar with some terms/techniques.
Edit: Found soultion
Instead of:
res.cookie('session', sessionCookie);
res.send("done");
I needed to use:
res.setHeader('Cache-Control', 'private');
res.cookie('__session', sessionCookie);
res.send("done");
Firebase allows a single cookie named "__session"