title: Node.js, Angular, express-session: Chrome 80 does not save session because of cookie policy (sameSite cookies)
body: <p>I have a Node.js, Angular app. (Node.js server written in TypeScript).
  Node.js Server is running on an Amazon EC-2 instance, the Angular client is on another server.</p>
  
  <p><strong>For the login session, I use express-session. I am not using cookies in the app, so I think the problem is with the express-session cookies.</strong>
  On Firefox it works properly, but with Google Chrome (80.0.3987.149) it not works: Chrome doesn't save the session (so I can not leave the login page) and warns:</p>
  
  <blockquote>
    <p>A cookie associated with a cross-site resource at <a href="http://addressof.myserverapp.com/" rel="noreferrer">http://addressof.myserverapp.com/</a> was set without the <code>SameSite</code> attribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set with <code>SameSite=None</code> and <code>Secure</code>. You can review cookies in developer tools under Application>Storage>Cookies and see more details at <a href="https://www.chromestatus.com/feature/5088147346030592" rel="noreferrer">https://www.chromestatus.com/feature/5088147346030592</a> and <a href="https://www.chromestatus.com/feature/5633521622188032" rel="noreferrer">https://www.chromestatus.com/feature/5633521622188032</a>.</p>
  </blockquote>
  
  <p>In Node.js server I set the express-sessions this way:</p>
  
  <pre class="lang-js prettyprint-override"><code>import cookieParser from 'cookie-parser';
  app.use(cookieParser(secret));
  
  app.use(session({
      secret: secret,
      resave: false,
      saveUninitialized: false,
      cookie: {
          httpOnly: false,
          maxAge: null,
          secure: true,
          sameSite: 'none'
      },
      store: sessionStore // MySqlStore - express-mysql-session
  }));
  </code></pre>
  
  <p>I also tried to solve the problem with this code snippet (from <a href="https://github.com/expressjs/session/issues/725#issuecomment-605922223" rel="noreferrer">https://github.com/expressjs/session/issues/725#issuecomment-605922223</a>)</p>
  
  <pre class="lang-js prettyprint-override"><code>Object.defineProperty(session.Cookie.prototype, 'sameSite', {
      // sameSite cannot be set to `None` if cookie is not marked secure
      get() {
          return this._sameSite === 'none' &amp;&amp; !this.secure ? 'lax' : this._sameSite;
      },
      set(value) {
          this._sameSite = value;
      }
  });
  </code></pre>
  
  <p>Server npm packages:</p>
  
  <pre><code>"cors": "^2.8.5",
  "cookie-parser": "^1.4.5",
  "express": "^4.17.1",
  "express-mysql-session": "^2.1.3",
  "express-session": "^1.17.0",
  </code></pre>
  
  <pre><code>Npm version: 6.13.4
  Node version: 12.16.1
  </code></pre>
  
  <p>I spent days with this problem to figure out what am I doing wrong...</p>