@nullpointer said in Connecting to socket endpoint from a custom frontend:
var socket = io('https://dev-forum.domain.io', { transport: ["polling", "websocket"], path: "/socket.io/", extraHeaders: { withCredentials: true, cookie: 'express.sid=s%3Am0UuuyatTTSajjAnI5gGSukaJSHJaiKpIVhb3H7L.TW4c4vZn4blOnWV1gilF9HhMqFc9g9V7NnLLZHMAmFg; Domain=dev-forum.domain.io; Path=/; HttpOnly; SameSite=Lax', }, });
withCredentials is not a header - it's an option that should be on the same level in the settings object as extraHeaders. It should be used instead of setting the cookie header manually in the browser - but it will only work if the browser has the cookies for the website you're connecting to and needs explicit permission from it via headers (the Access-Control-Allow-* headers).
This should look more like this:
The reason the NodeBB test example works is that it's not ran inside a browser - NodeJS, as a server environment, has quite different security requirements than browsers and also just can't save credentials for each page (imagine what programming horror having this kind of mutable state in code would be...). I'm not sure what is your ultimate goal with this code, so that's why I mentioned the cookies as needed for server-side code.
