Puan
28,728
Çözümler
0
- Konum
- Freanchey
- Mesajlar
- 3,049
- Katılım
- 2 Eki 2026
- Tepkime puanı
- 3,565
- Puan
- 28,728
- Web sitesi
- glomaxgpt.com
Table of ContentsHow to Fix Missing HTTP-Only Refresh Cookies in Express and ReactTable of ContentsWhy Refresh Cookies DisappearHow HTTP-Only Refresh Tokens Work with Express and ReactExpress 5 Server Setup: Login, Refresh, and Logout RoutesReact Client: Credential-Aware Fetch and Token StorageTroubleshooting Table: Cookie and CORS MisconfigurationsEnd-to-End Verification ChecklistCommon Pitfalls with Express 5Next Steps for Production HardeningTable of ContentsHow to Fix Missing HTTP-Only Refresh Cookies in Express and ReactTable of ContentsWhy Refresh Cookies DisappearHow HTTP-Only Refresh Tokens Work with Express and ReactExpress 5 Server Setup: Login, Refresh, and Logout RoutesReact Client: Credential-Aware Fetch and Token StorageTroubleshooting Table: Cookie and CORS MisconfigurationsEnd-to-End Verification ChecklistCommon Pitfalls with Express 5Next Steps for Production HardeningExpress React Refresh Token Setup: Diagnosing Missing Cookies and 401sSitePoint TeamPublished inJavaScript·Programming·Web·October 9, 2026·Updated: October 9, 2026The AI briefing for DevelopersStay up to date with AI tools, model releases, and developer workflows that matter.Weekly. Free. One click to leave.Share this articleSitePoint PremiumStay Relevant and Grow Your Career in TechPremium ResultsPublish articles on SitePointDaily curated jobsLearning PathsDiscounts to dev toolsStart Free Trial7 Day Free Trial. Cancel Anytime.
A familiar Stack Overflow symptom: the login request completes with a 200 status, the response body contains the expected access token, but the HTTP-only refresh cookie never appears under DevTools > Application > Cookies. An express React refresh token setup that worked in Postman quietly fails in the browser, producing cascading 401 errors on every subsequent API call.
How to Fix Missing HTTP-Only Refresh Cookies in Express and React
Add credentials: 'include' to every fetch or Axios call from the React client.
Set credentials: true and an explicit origin (not *) in the Express CORS middleware.
Configure cookie attributes: httpOnly: true, secure: true (production), and sameSite: 'None' for cross-origin or 'Lax' for same-site development.
Register cookie-parser middleware before all route definitions so req.cookies is populated.
Rotate the refresh token on every successful /api/refresh call by setting a new cookie in the response.
Implement a single-flight promise guard in the client to prevent concurrent 401 retries from racing on token rotation.
Verify the cookie appears in DevTools under the server's domain (e.g., localhost:4000), not the React dev server's domain.
Redirect to the login page on refresh failure instead of retrying, to avoid 401 loops.
Why Refresh Cookies Disappear
How HTTP-Only Refresh Tokens Work with Express and React
Express 5 Server Setup: Login, Refresh, and Logout Routes
React Client: Credential-Aware Fetch and Token Storage
Troubleshooting Table: Cookie and CORS Misconfigurations
End-to-End Verification Checklist
Common Pitfalls with Express 5
Next Steps for Production Hardening
A familiar Stack Overflow symptom: the login request completes with a 200 status, the response body contains the expected access token, but the HTTP-only refresh cookie never appears under DevTools > Application > Cookies. The developer inspects headers, toggles filters, clears storage, and still sees nothing. An express React refresh token setup that worked in Postman quietly fails in the browser, producing cascading 401 errors on every subsequent API call.
The root cause is not a bug in Express or React. In most cases, the client's credential handling, the server's CORS configuration, and the cookie attribute settings disagree. A single missing flag, whether credentials: 'include' on the client or sameSite: 'None' on the server, is enough to make the browser silently discard or refuse to send the cookie.
This article delivers a copy-and-run Express 5 + React 18+ token-based authentication setup with JWT access and refresh tokens, cookie-parser, and the Fetch API. It includes a diagnostic troubleshooting table mapping symptoms to fixes and a single-flight 401 retry wrapper that prevents race conditions during silent token rotation.
Prerequisites: Node.js ≥ 18.0.0 (required by Express 5). Verify with node -v.
How HTTP-Only Refresh Tokens Work with Express and React
Access Token vs. Refresh Token Lifecycle
The jwt refresh token React pattern splits authentication into two tokens with different lifetimes and storage strategies. The access token is a short-lived JWT (typically 15 minutes). The app stores it only in memory, never in localStorage or sessionStorage, because those are readable by any script running on the page. The refresh token is a long-lived JWT (7 days in this implementation). The server delivers it to the browser as an HTTP-only, Secure, SameSite cookie.
A familiar Stack Overflow symptom: the login request completes with a 200 status, the response body contains the expected access token, but the HTTP-only refresh cookie never appears under DevTools > Application > Cookies. An express React refresh token setup that worked in Postman quietly fails in the browser, producing cascading 401 errors on every subsequent API call.
How to Fix Missing HTTP-Only Refresh Cookies in Express and React
Add credentials: 'include' to every fetch or Axios call from the React client.
Set credentials: true and an explicit origin (not *) in the Express CORS middleware.
Configure cookie attributes: httpOnly: true, secure: true (production), and sameSite: 'None' for cross-origin or 'Lax' for same-site development.
Register cookie-parser middleware before all route definitions so req.cookies is populated.
Rotate the refresh token on every successful /api/refresh call by setting a new cookie in the response.
Implement a single-flight promise guard in the client to prevent concurrent 401 retries from racing on token rotation.
Verify the cookie appears in DevTools under the server's domain (e.g., localhost:4000), not the React dev server's domain.
Redirect to the login page on refresh failure instead of retrying, to avoid 401 loops.
Why Refresh Cookies Disappear
How HTTP-Only Refresh Tokens Work with Express and React
Express 5 Server Setup: Login, Refresh, and Logout Routes
React Client: Credential-Aware Fetch and Token Storage
Troubleshooting Table: Cookie and CORS Misconfigurations
End-to-End Verification Checklist
Common Pitfalls with Express 5
Next Steps for Production Hardening
A familiar Stack Overflow symptom: the login request completes with a 200 status, the response body contains the expected access token, but the HTTP-only refresh cookie never appears under DevTools > Application > Cookies. The developer inspects headers, toggles filters, clears storage, and still sees nothing. An express React refresh token setup that worked in Postman quietly fails in the browser, producing cascading 401 errors on every subsequent API call.
The root cause is not a bug in Express or React. In most cases, the client's credential handling, the server's CORS configuration, and the cookie attribute settings disagree. A single missing flag, whether credentials: 'include' on the client or sameSite: 'None' on the server, is enough to make the browser silently discard or refuse to send the cookie.
This article delivers a copy-and-run Express 5 + React 18+ token-based authentication setup with JWT access and refresh tokens, cookie-parser, and the Fetch API. It includes a diagnostic troubleshooting table mapping symptoms to fixes and a single-flight 401 retry wrapper that prevents race conditions during silent token rotation.
Prerequisites: Node.js ≥ 18.0.0 (required by Express 5). Verify with node -v.
How HTTP-Only Refresh Tokens Work with Express and React
Access Token vs. Refresh Token Lifecycle
The jwt refresh token React pattern splits authentication into two tokens with different lifetimes and storage strategies. The access token is a short-lived JWT (typically 15 minutes). The app stores it only in memory, never in localStorage or sessionStorage, because those are readable by any script running on the page. The refresh token is a long-lived JWT (7 days in this implementation). The server delivers it to the browser as an HTTP-only, Secure, SameSite cookie.
