如何对 http 和 https 请求使用 express session 的 cookie 的安全属性？

Question

我正在开发一个提供短期贷款的应用程序。我已将快速会话的 cookie 安全属性设置为 false。当我向本地主机发送请求时，标头是 http。所以 cookie 得到设置，结果没有错误发生。但是，当我连接到外部支付网关进行交易时，标头设置为 https，因此 cookie 无法正确设置并引发错误。那么，如何根据 http 或 https 标头条件使用 cookie 属性 我的 app.js 的代码是：

//database connection
const mongoose = require('mongoose');
mongoose.connect("mongodb+srv://sifat:[email protected]/test", function(err) {
    if (err) {
        console.log("Database Not Connected", err);
    } else {
        console.log("Database Connected")
    }
});
mongoose.set('useFindAndModify', false);










//App creation
const express = require("express");
const app = express();

//port setup
require('dotenv').config();
const port = process.env.PORT || 8080;











//Other usage for application
app.use(express.static("public"));
app.set('view engine','ejs');
const cookieParser = require('cookie-parser')
app.use(cookieParser(process.env.SESSION_SECRET));
app.use(require('express-session')({
    secret: process.env.SESSION_SECRET,
    cookie : { maxAge: 24 * 60 * 60 * 1000, secure: false},
    resave: true,
    saveUninitialized: true
}));

//body parser configutation
const bodyParser = require('body-parser');
app.use(bodyParser.urlencoded({extended: false}));


//passport configuration
const passport = require('passport');
app.use(passport.initialize());
app.use(passport.session());

const localStrategy = require('passport-local');
const User = require('./models/user');
passport.use(new localStrategy(User.authenticate()));
passport.serializeUser(User.serializeUser());
passport.deserializeUser(User.deserializeUser());


//router configuration
const userRoutes = require('./routes/user');
app.use('/user',userRoutes);
const loanRoutes = require('./routes/loan');
app.use('/loan',loanRoutes);
const adminRoutes = require('./routes/admin');
app.use('/admin',adminRoutes);
const paymentRoutes = require('./routes/payment');
app.use('/payment',paymentRoutes);

//caching configuration
app.use((req,res,next) => {
    res.set('Cache-Control','no-cache, private, no-store, must revalidate, max-stale=0, post-check=0, pre-check=0')
    res.locals.currentUser = req.user;
    next();
});


//morgan configuration
const morgan = require('morgan');
app.use(morgan('dev'));

//Home page
app.get('/',(req,res)=>{res.render('home');})

//Server Start
app.listen(port, () => {console.log(`Server is running on port ${port}`);});

当我尝试设置 cookie: {secure: true} 时，输出是

Session {
  cookie:
   { path: '/',
     _expires: 2023-03-03T19:43:40.653Z,
     originalMaxAge: 86400000,
     httpOnly: true,
     secure: false },
  passport: { user: 'Sifat Sikder' } }

当我尝试设置 cookie: {secure: false} 时，输出是

Session {
  cookie:
   { path: '/',
     _expires: 2023-03-03T19:43:40.653Z,
     originalMaxAge: 86400000,
     httpOnly: true,
     secure: false }
 }

这是抛出错误