Express-Session not working in production/deployment

Question

Express-Session is working in development environment, as it sets the "connect.sid" cookie in my browser. However, in production it's not storing the cookie, and instead of using the same session - it creates a new one every time. I believe that the issue would be fixed if I can somehow save third party cookies, as my app was deployed using Heroku. Lastly, I have also used express-cors to avoid the CORS issue (don't know if this has anything to do with the cookie issue). I have set {credentials: true} in cors, {withCredentials: true} in Axios, as well.

Answer 1

Issue Solved: -> Add sameSite: 'none' Full Cookie config (express-session) for production:

cookie: { httpOnly: true, secure: true, maxAge: 1000 * 60 * 60 * 48, sameSite: 'none' }

Answer 2

Heroku uses reverse proxy. It offers https endpoints but then forwards unencrypted traffic to the website.

Try something like

app.enable('trust proxy')

And check out https://expressjs.com/en/guide/behind-proxies.html

Answer 3

Adding a "name" attribute to the session config worked for me:

{
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: true,
    proxy: true, // Required for Heroku & Digital Ocean (regarding X-Forwarded-For)
    name: 'MyCoolWebAppCookieName', // This needs to be unique per-host.
    cookie: {
      secure: true, // required for cookies to work on HTTPS
      httpOnly: false,
      sameSite: 'none'
    }
  }