当 SameSite 为 none 时，Express 不会设置 cookie

Question

I have read a lot of other similar questions, but I couldn't solve the issue.

My setup is Node + Express + PassportJs and everything works in development, but I have problems on production.

With the following code, I see that the session cookie is sent back in the response, but I also get a message saying that it won't be applied as SameSite is lax (the default) and the response comes from another site (frontend and backend do not have the same origin).

app.use( 
    session({ 
        secret: "foo", 
        resave: false, 
        saveUninitialized: false, 
        store: MongoStore.create({ mongoUrl: process.env.MONGO_DB_CONN_STRING! }), 
        cookie: { httpOnly: true }
    }) 
); 

So I changed it to this, so to specify SameSite and Secure in production, but at this point, no cookie is set anymore!

app.use( 
    session({ 
        secret: "foo", 
        resave: false, 
        saveUninitialized: false, 
        store: MongoStore.create({ mongoUrl: process.env.MONGO_DB_CONN_STRING! }), 
        cookie: isProduction ? { httpOnly: true, sameSite: "none", secure: true } : {}  // <-- only change
    }) 
); 

What could be the cause? I've tried to fix it by playing with CORS (no success) and other 100 things. Yet it seems some quirk I am missing.

Answer 1

depending on what service you use to deploy your API(netlify, render.com, heroku other...) you have to enable proxy

 this.app.enable('trust proxy');

it fixed my issue