问在Heroku上托管的NodeJS应用程序不设置客户端cookie

EN

var express = require("express");
var bodyParser = require("body-parser");
var logger = require("morgan");
var methodOverride = require("method-override");
var cors = require("cors");
var cookieParser = require("cookie-parser");
var session = require("express-session");
var bcrypt = require("bcrypt-nodejs");

var appURL = "https://xxxxxxxxxxxxx.firebaseapp.com";

var app = express();
app.use(logger("dev"));
app.use(bodyParser.json());
app.use(methodOverride());

app.use(cors({origin: appURL, credentials: true, methods: "GET,POST"}));
app.use(cookieParser());

app.all('*', function(req, res, next) {

    res.setHeader("Access-Control-Allow-Origin", appURL);
    res.setHeader("Access-Control-Allow-Headers", "X-Requested-With");
    res.setHeader("Access-Control-Allow-Credentials", true);
    next();
});

app.set("trust proxy",1);

app.use(session({
    name: "random_session",
    secret: "yryGGeugidx34otGDuSF5sD9R8g0Gü3r8",
    resave: false,
    saveUninitialized: true,
    cookie: {
        path: "/",
        secure: true,
        domain: ".firebaseapp.com",
        httpOnly: true
    }
}));

      let data = {
        email: this.loginField,
        password: this.passwordField
      }

      var xhr = new XMLHttpRequest();
      xhr.open("POST","https://xxxxxxxxxx.herokuapp.com/login", true);
      xhr.withCredentials = true;

      var change = () => {
        if(xhr.readyState == XMLHttpRequest.DONE) {

          if(xhr.status != 0) {

            if (xhr.status != 401 && xhr.status != 404) {

              //Login Successfull

            } else {
            //Login Fail
            }

          } else {
            //Network error
          }

        }
      }

      xhr.onreadystatechange = change;

      xhr.setRequestHeader("Access-Control-Allow-Origin","https://xxxxxxxxxx.firebaseapp.com");
      xhr.setRequestHeader("Access-Control-Allow-Credentials", "true");
      xhr.setRequestHeader("Content-Type", "application/json");

      xhr.send(JSON.stringify(data));