express-session cookies blocked in browsers

Viewed 9

I know this question is redundant, but I have been searching and reading articles all around for hours now. I am using express-session to control user sessions for the express server. It works when I try to console req.session.user from a postman request. When I try to fire the same request from the browser, it returns undefined. Everyone is talking about Chrome security updates and third-party cookies restrictions. I've tried to stick to chrome guidelines on cookie options but didn't help. If I deployed my client or server to a secure domain would it help?

Here are my options

app.use(cors())

app.set('trust proxy', 1) // trust first proxy
app.use(session({
    store: new (require('connect-pg-simple')(session))({pool}),
    secret: process.env.SESSION_SECRET,
    resave: true,
    rolling: true,
    cookie: {
        maxAge: 30 * 60 * 1000, // 30 minutes
        secure: false,
        sameSite: 'none'
    },  
    saveUninitialized: false,
}));

0 Answers
Related