Trouble using express.session with https

Question

I have to use authentication and then create a session for this i have a HTTPS static website running on expressjs

Code :

app.js:

//created the https server

var express = require('express');
var https = require('https');
var http = require('http');
var fs = require('fs');
var mongo = require('mongodb');
var monk = require('monk');
var db = monk('localhost:27017/svgtest1');

// This line is from the Node.js HTTPS documentation.
var options = {
  key: fs.readFileSync('privatekey.pem'),
  cert: fs.readFileSync('certificate.pem')
};

// Create a service (the app object is just a callback).
var app = express();

app.use(express.static(__dirname + '/public'));
app.use(express.cookieParser());
app.use(express.session({cookie: { httpOnly: false , maxAge: 24*60*60*1000}, secret: '1234567890QWERT'}));
app.use(express.urlencoded());
app.use(express.json());


// middle ware to check auth
function checkAuth(req, res, next) {
  if (!req.session.user_id) {
    res.send('You are not authorized to view this page');
  } else {
    next();
  }
}


app.get('/', function(req, res) {
  console.log('First page called');
  res.redirect('xyz.html');
  res.end();
});

app.post('/login', function(req, res) {
  console.log('login called');
  var usrfield = req.body.usrfield;
  var passfield = req.body.passfield;

    // Play with the username and password

    if (usrfield == 'xxx' && passfield == 'xxx') {
    req.session.user_id = '123';
    res.redirect('abc.html');
  } else {
    res.send('Bad user/pass');
  }


    console.log(usrfield);
    console.log(passfield);
    res.end();
});


// Create an HTTPS service.
https.createServer(options, app).listen(8888);

When I visits https://localhost:8888 it continuously loads the page and does not redirect to xyz.html where i have to enter the credentials to authenticate the user ?
When I comment out

app.use(express.session({cookie: { httpOnly: false , maxAge: 24*60*60*1000}, secret: '1234567890QWERT'}));

Then the page loads correctly but when i post the form to /login then it says req.session cannot be written. For this i know because i have comment out the express.session, but the strange thing is that connect.sid cookie is created. Why ?

I am confused regarding question 1 and 2.

Ethan Brown Ethan Brown · Accepted Answer · 2014-01-11T01:37:20

I tried your example, and it works for me. Are you sure you're using the https protocol in the browser? By default, a browser will try to connect with HTTP protocol unless you redirect to HTTP. With your set, navigating to this URL will just spin:

http://localhost:8888

However, if you navigate to this URL:

https://localhost:8888

It will work as expected. Most servers that use HTTPS automatically redirect to an HTTPS connection if the user came in over HTTP, but you still have to have two servers: one accepting HTTP request, and the other accepting HTTPS requests. For example, you could do this:

// create an HTTPS service
https.createServer(options, app).listen(443);

// create HTTP service to redirect to HTTPS
http.createServer(express().use(function(req,res){
    res.redirect('https://localhost:443' + req.url);
})).listen(8888);

Note that if you use ports below 1024 (such as 443, which is common for HTTPS), you'll probably have to have elevated privileges depending on your server set up. In OSX/Linux, you would just do sudo node app.js. Of course you don't have to run on port 443: you could have your HTTPS server run on 8887 and your HTTP redirect server run on 8888.

Trouble using express.session with https

1 Answers