Tools: Debugging Dynamic Cookie Validation in Express.js

When building multi-tenant applications, validating cookies per domain can be tricky. I recently worked on a project where each domain had its own cookie configuration, and I wanted to ensure the correct cookie was being read for each request. Dynamic Cookie Access
Using parse(req.hostname).hostname allows you to determine which cookie to check for the current request dynamically. This is especially useful for multi-domain setups. Early Debugging
Adding a console.log statement for the hostname helps confirm which domain the request is coming from and whether the correct cookie name is being used. Fail Fast
Always check for missing cookies and return an unauthorized response early to prevent unauthorized access. Without this setup, your multi-domain app could mistakenly use the wrong cookie, leading to authentication errors. Dynamic validation ensures every request is verified against its intended domain configuration. Templates let you quickly answer FAQs or store snippets for re-use. Are you sure you want to hide this comment? It will become hidden in your post, but will still be visible via the comment's permalink. Hide child comments as well For further actions, you may consider blocking this person and/or reporting abuse COMMAND_BLOCK:
public validateToken: RequestHandler = catchAsync( async (req: Request, res: Response, next: NextFunction): Promise<void> => { // Extract the hostname dynamically from the request const host = parse(req.hostname).hostname; // Get the access cookie name for this domain const { ACCESS } = DOMAIN_COOKIE[host as keyof typeof DOMAIN_COOKIE]; console.log('Debug Mode – Hostname:', host); if (!ACCESS) { return this.unauthorized(req, res, next); } const accessCookie = req.signedCookies[ACCESS]; // If the access token is missing, throw an unauthorized error if (!accessCookie) { return this.unauthorized(req, res, next); } // Continue to next middleware or route next(); }
); Enter fullscreen mode Exit fullscreen mode COMMAND_BLOCK:
public validateToken: RequestHandler = catchAsync( async (req: Request, res: Response, next: NextFunction): Promise<void> => { // Extract the hostname dynamically from the request const host = parse(req.hostname).hostname; // Get the access cookie name for this domain const { ACCESS } = DOMAIN_COOKIE[host as keyof typeof DOMAIN_COOKIE]; console.log('Debug Mode – Hostname:', host); if (!ACCESS) { return this.unauthorized(req, res, next); } const accessCookie = req.signedCookies[ACCESS]; // If the access token is missing, throw an unauthorized error if (!accessCookie) { return this.unauthorized(req, res, next); } // Continue to next middleware or route next(); }
); COMMAND_BLOCK:
public validateToken: RequestHandler = catchAsync( async (req: Request, res: Response, next: NextFunction): Promise<void> => { // Extract the hostname dynamically from the request const host = parse(req.hostname).hostname; // Get the access cookie name for this domain const { ACCESS } = DOMAIN_COOKIE[host as keyof typeof DOMAIN_COOKIE]; console.log('Debug Mode – Hostname:', host); if (!ACCESS) { return this.unauthorized(req, res, next); } const accessCookie = req.signedCookies[ACCESS]; // If the access token is missing, throw an unauthorized error if (!accessCookie) { return this.unauthorized(req, res, next); } // Continue to next middleware or route next(); }
);