Flask set_cookie 不生效：深入解析与正确实践

# main.py
from flask import Flask, make_response, jsonify
from flask_cors import CORS, cross_origin
import jwt # 假设已经安装并配置了jwt
import os # 用于SECRET_KEY

app = Flask(__name__)
# 确保CORS配置支持凭证，以便前端能接收到Cookie
CORS(app, supports_credentials=True)

# 假设 SECRET_KEY 和 db 配置已存在
SECRET_KEY = os.environ.get('SECRET_KEY', 'your_super_secret_key')
# 模拟一个简单的数据库查询
class MockDB:
    def __init__(self):
        self.users = [{"email": "test@example.com", "_id": "12345"}]
    def find(self, query):
        # 简单模拟查询，实际应从MongoDB等数据库获取
        return [u for u in self.users if u["email"] == query["email"]]
db = {'users': MockDB()}

@app.route('/')
def principal():
    return 'Welcome to the CharTwo API.'

@app.route('/api/account/login', methods=['POST'])
@cross_origin(supports_credentials=True)
def login_account_route():
    # 实际应用中应从request.json获取email和password
    # 这里为了演示，假设直接调用loginAccount
    email = "test@example.com" # 模拟从请求中获取
    return loginAccount(email) # 将email作为参数传入

def loginAccount(email):
    # 模拟用户ID获取
    user_data = list(db['users'].find({"email": email}))
    if not user_data:
        # 处理用户不存在的情况
        return jsonify({"error": "User not found"}), 404

    userId = str(user_data[0]['_id'])

    # 生成JWT令牌
    # 注意：这里为了简化，直接使用email，实际应使用更安全的载荷
    tokenId = jwt.encode({'userId': userId}, SECRET_KEY, algorithm='HS256')

    # 准备响应消息
    mensagem = {'message': f'Welcome to the CharTwo {email}!', 'tokenId': tokenId}

    # 创建一个Flask响应对象
    response = make_response(jsonify(mensagem))

    # 在响应对象上设置Cookie
    # 注意：这里设置的Cookie名称为'accessToken'
    response.set_cookie('accessToken', tokenId, httponly=True, secure=True, samesite='Lax')

    # 返回这个包含了Cookie的响应对象
    return jsonify(mensagem) # 错误的返回方式

if __name__ == '__main__':
    app.run(debug=True)

# user.py (或直接在main.py中)

# 假设 SECRET_KEY 和 db 配置已存在
# from flask import make_response, jsonify
# import jwt
# import os
# SECRET_KEY = os.environ.get('SECRET_KEY', 'your_super_secret_key')
# class MockDB:
#     def __init__(self):
#         self.users = [{"email": "test@example.com", "_id": "12345"}]
#     def find(self, query):
#         return [u for u in self.users if u["email"] == query["email"]]
# db = {'users': MockDB()}

def loginAccount(email):
    user_data = list(db['users'].find({"email": email}))
    if not user_data:
        return jsonify({"error": "User not found"}), 404

    userId = str(user_data[0]['_id'])
    tokenId = jwt.encode({'userId': userId}, SECRET_KEY, algorithm='HS256')

    mensagem = {'message': f'Welcome to the CharTwo {email}!', 'tokenId': tokenId}

    # 关键步骤：创建响应对象并将其存储在变量中
    response = make_response(jsonify(mensagem))

    # 在这个响应对象上设置Cookie
    # 建议添加httponly, secure, samesite等属性以增强安全性
    response.set_cookie(
        'accessToken',
        tokenId,
        max_age=3600,  # Cookie有效期，例如1小时
        httponly=True, # 阻止客户端脚本访问Cookie
        secure=True,   # 仅在HTTPS连接下发送Cookie
        samesite='Lax' # 跨站请求策略
    )

    # 返回这个已经设置了Cookie的响应对象
    return response # 正确的返回方式