cookie-session | Simple cookie-based session middleware | Runtime Evironment library

You cannot host a Next/express app on Vercel because the Express server must be running all the time, but Vercel is made for serverless functions.

Two possible solutions:

1. Host your app in Heroku or a vps
2. Remove Express, just use Next api routes and you will easily deploy on Vercel

Reference

Browsers can store the cookie even if you restart them. You have to send additional header informations, which can be a date in the past to make sure it is expired when the session ends or disallow caching of the cookie, which can be done with the Cache-Control: private or Cache-Control: no-cache="set-cookie" directive.

MDN HTTP Cookies:

• Session cookies are deleted when the current session ends. The browser defines when the "current session" ends, and some browsers use session restoring when restarting, which can cause session cookies to last indefinitely long.

RFC 2109 Section 4.2.3 says:

If the cookie is intended for use by a single user, the Set-cookie header should not be cached. A Set-cookie header that is intended to be shared by multiple users may be cached.

The origin server should send the following additional HTTP/1.1 response headers, depending on circumstances:

• To suppress caching of the Set-Cookie header: Cache-control: no-cache="set-cookie".

You need to associate the scope with your registry:

You are not copying all of the source code in the second container, instead copying only one file, ie) server.js. Offending line is,

The main difference between express-session and cookie-session is how they save cookie session data.

The express-session middleware stores session data on the server; it only saves the session ID in the cookie itself, not session data. By default, it uses in-memory storage and is not designed for a production environment. In production, you’ll need to set up a scalable session-store like database.

In contrast, cookie-session middleware implements cookie-backed storage: it serializes the entire session to the cookie, rather than just a session key. Only use it when session data is relatively small and easily encoded as primitive values (rather than objects).

While JWTs provide a means of maintaining session state on the client instead of doing it on the server, it's just a token with payload data containing user, created time, etc (which should not be sensitive). JWT usually used for authorization, is sent to the server via bearer token in Authorization header. Browser will automatically send cookies with each request to the server when using cookie-session module, but bearer tokens need to be added explicitly to the HTTP header while making request.

The reason the req.session object was different on Server1 and Server2, is because of something that took me a while to track down, though it's painfully simple.

After isolating cookie-session as the culprit, I finally looked at my package.json to find servers had the different versions of cookie-session installed. (2.0Beta & 1.4.0) Once I installed v1.4.0 on both servers, everything works as expected.

I found a solution there for the people that might struggle like me...i think it's a bit of hacky but it work well.

I was observing in my front that the socket were all the time triggering under the /socket.io/.... and if you take a look at my ingress nginx that would look into my react app and return a 404 page probably.

So i forced my chat-srv to be present there on this specific endpoint with the following code:

Ok. I just found out what went wrong myself and just thought I'd share with anyone who's got the same problem.

My codes were all correct except Heroku doesn't recognise .env and all the secrets saved in .env file will not be picked by Heroku which I wasn't aware of.

The solution is simply go in 'Setting' (in Heroku dashboard) -> Config Vars -> click 'Reveal Config Vars' -> add 'Key' and 'Value' of your secrets (e.g Key: GOOGLE_CLIENT_ID , Value: 'your API Key') then click 'Add'

You can add multiple key, value pairs as you need.

Looks like your situation is to be nested twice node_modules (node_modules/@opt-ui/icons/node_modules/@equinor/eds-icons), so you might have to set both @opt-ui and @equinor to re-transpile.

However, I have an idea which I'm not 100% the following way would work but it's worth trying though: