Google app engine removes session cookies when authorizing socket.io connection - google-app-engine

Question

I am trying to get the sessionID of a user from express-session when the user opens up a WebSocket connection. The code below shows how this is done. The problem is that when I deploy my server to google app engine, I can no longer see the session cookie when authorizing the socket connection. It works fine when running locally, so google app engine must be doing something to remove the cookie? I'm not too familiar with the google app engine so any help would be greatly appreciated.
I've tried many different solutions I found online such as passport.socketio from npm, many of which I believe implement the same solution that I ended up writing myself.
Edit 1:
To be more specific, data.headers.cookies contains an io, connect.sid and express.sid cookie when running from localhost. When running on the google app engine, it only contains the io cookie. (End of edit)
Edit 2:
I thought it could be an issue with having different instances of my server due to google's automatic scaling, so I've changed my setting in app.yaml to ensure that wont happen:
network:
session_affinity: true
manual_scaling:
instances: 1
(End of edit)
Code:
var session = require('express-session');
var MemoryStore = require('memorystore')(session);
var store = new MemoryStore({
checkPeriod: 86400000
}); // Likely to switch to RedisStore
app.use(session({
store: store,
secret: 'jpcs-0001080900DRXPXL',
saveUninitialized: false,
resave: true,
key: 'express.sid'
}));
// ...
io.set('authorization', (data, accept) => {
if (data && data.headers && data.headers.cookie) {
console.log('COOKIES:');
console.log(data.headers.cookie);
cookies_str = data.headers.cookie;
cookies_arr = cookies_str.split(';');
cookies = {};
for (index in cookies_arr) {
cookie = cookies_arr[index].split('=');
if (cookie.length != 2) continue;
key = cookie[0].replace(/ /g,'');
val = cookie[1];
cookies[key] = val;
}
if (!cookies['express.sid']) accept('User not signed in', null);
// HERE IS MY PROBLEM:
// When running from google app engine cookies['express.sid'] is null
sessionId = cookies['express.sid'].split('.')[0].substring(4);
data.sessionId = sessionId;
store.get(sessionId, (err, session) => {
if (!err && session) {
data.session = session;
accept(null, true);
}
else if (err) accept('Could not get session', false);
else if (!session) accept('Could not get session', false)
});
}
accept('Could not get session', false);
});
So I expect cookies['express.sid'] to contain the sessionID in it, but on google app engine it is null.
App.yaml
runtime: nodejs10 # For Node.js 8, use runtime: nodejs8
#instance_class: F2
#env_variables:
#BUCKET_NAME: "example-gcs-bucket"
handlers:
- url: .*
secure: always
redirect_http_response_code: 301
script: auto
network:
session_affinity: true
manual_scaling:
instances: 1

Answer 1

It's more likely that your application cannot retrieve the user from the session store when running on GAE due to a network or app configuration. Some more info on which session store you are using, the configuration for it in express, and the app.yaml would be more helpful in solving this. Its unlikely that GAE would be removing the cookie from the HTTP response headers.
I found that in order to use redis with express/express-session I needed to set the network name in app.yaml.
network:
name: default
Unfortunately it doesn't seem like you can use this for standard environments, so I also had to change:
runtime: nodejs
env: flex
And also needed to specify an engine in package.json when switching to a flexible environment.
"engines": {
"node": "10.x"
}