Cookie issue - handshake error when using socket.io

Question

JavaScript

Our programmer made a site based on the Node.JS engine and everything works great on his local computer - both when accessing from the localhost and when accessing over the network. I place this creation on our server and put the entire list of modules that it uses. Doesn't work... The

debriefing showed that the script in the socket.io.min.js file calls 192.168.122.252:3000/socket.io/1/?t=1379433566379 from the server. On the server, this calls the handler described in the following block of code:

io.configure(function (){
  io.set('authorization', function (handshakeData, callback) {
    // некоторый код по анализу
  });
});

after processing, the server issues a message to the console: "warn - handshake error", and returns the text "handshake error" to the client. The situation repeats stably when testing from browsers on the server itself and from its network.

I added the JSON serialization of the handshakeData parameter to the authorization procedure and got the result on the server:

Coockie: {"headers":{"host":"192.168.122.252:3000","connection":"keep-alive","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","user-agent":"Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36","accept-encoding":"gzip,deflate,sdch","accept-language":"ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4"},"address":{"address":"192.168.122.135","port":3146},"time":"Tue Sep 17 2013 19:16:16 GMT+0300 (EEST)","query":{"t":"1379433566379"},"url":"/socket.io/1/?t=1379433566379","xdomain":false,"issued":1379434576801}

But the developer on his work machine still has cookies in the headers, and therefore the contents of the authorization handler are successfully executed, no warning is generated, and the web service is running:

Coockie: {"headers":{"host":"localhost:3000","connection":"keep-alive","user-agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36","accept":"*/*","referer":"http://localhost:3000/","accept-encoding":"gzip,deflate,sdch","accept-language":"en-US,en;q=0.8","cookie":"auth.sid=s%3APjHB8aINSzgpvDqgPLtcwkSp.VVyPsLtWzyJKzooaePC2Yg1WaISVp5ew6x1e88jGhLY"},"address":{"address":"127.0.0.1","port":44417},"time":"Tue Sep 17 2013 19:02:40 GMT+0300 (EEST)","query":{"t":"1379433760241"},"url":"/socket.io/1/?t=1379433760241","xdomain":false,"issued":1379433760263}

What am I missing for the second day? Maybe some specific settings for Express are needed?

Answer 1

sessions are stored where? line express.session(?)
express 2 or 3?

Answer 2

Is there a cookie in the browser at all?
If there is, then it may not be transmitted if the client and server are on different domains (or https is used)? Dig towards the Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers.
To complete the picture, lay out the request and response headers (you can see them directly in the browser) and the client and server domains.

Answer 3

Of course, I'm not sure what's wrong, but so, purely hypothetically, maybe the cookie has an httpOnly parameter?