Creating cookies by calling PHP website from Node API - php

Question

We have our current website in PHP. We are currently upgrading it in Node. We will upgrade it step by step so we'll have some pages in PHP and some other in Node.
Problem is, when users will connect we have to make sure they have a session in both PHP and Node, so they won't have to connect twice.
In PHP we create a PHPSESSID cookie and we store all the data in a session file in /tmp.
In Node we use a JWT token.
What i am trying to achieve right now is: when and user connects with a page that runs on Node, it has to create a PHPSESSID cookie and the session file, so when he will navigate to another page that runs on PHP he will still be connected.
The PHP website and the Node API have the same domain but run on a different port.
Right now what my code does is:
I call the signIn function from the Node API
It creates the JWT token and the user is connected properly in Node
I call the PHP website like this: http://www.mysite.local/ajax/login?user=user&pass=pwd
It creates the session file correctly
It creates the PHPSESSID cookie
But when i check the cookies of my domain, the PHPSESSID doesn't appear. But it does after i create it and print $_COOKIE in PHP.
And because of that PHP can't find any PHPSESSID cookie and can't access the session file.
I'm using Node with GraphQL and Apollo, and PHP with Zend Framework 1.12
Here is how i call PHP with Node:
const url = `http://www.mysite.local/ajax/login?email=${data.email}&password=${data.password}`
const headers = {
Referer: 'http://www.mysite.local/auth'
}
await fetch(url, { method: 'GET', headers: headers })
The sessions in PHP are managed by Zend
I'm testing on Firefox.

Answer 1

HTTP cookies work like this:
The client sends an HTTP request to the server
The server responds with an HTTP response which includes a Set-Cookie header
The client then stores the cookie
Later on, the client sends another HTTP request to the same server. Since it has a stored cookie, the cookie is including in the request headers.
Browsers will, in general, automatically store cookies. (There are some edge cases, like Ajax requests only handling cookies in cross-origin requests if withCredentials is enabled).
Server-side code will, in general, not automatically store cookies. When dealing with server-side code you usually need to explicitly deal with cookies, usually by configuring a cookie jar library (e.g. fetch-cookie).
You are making an HTTP request from the browser to Node.js.
Node.js is making an HTTP request to PHP.
PHP is responding with a cookie (I assume)
Node.js is ignoring the cookie
Node.js is making an HTTP response to the browser
The browser gets the HTTP response (with no Set-Cookie header in it).
At no point does Node.js either read the cookie from the request it made to PHP or copy that cookie in the response it makes to the browser.
That is what you need to do.
(And then you'll need to continue to proxy requests to the PHP through the Node.js because the cookie stored in the browser would be associated with the Node.js server).