title: Why express-session (SameSite atribute) isn't working on Chrome?
body: <p>I am developing a web app with Express.js and React.js.
  I am using express-session but it is not working.
  This is how i am using it:</p>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>app.use(session({
    store: new MongoStore({
      mongooseConnection: mongoose.connection,
      ttl: 365 * 24 * 60 * 60
    }),
    secret: process.env.SESSION_SECRET,
    resave: true,
    saveUninitialized: false,
    cookie: {
      maxAge: 24 * 60 * 60 * 1000,
      httpOnly: true, 
      secure: false,
      SameSite: 'strict',
    }
  }));</code></pre>
  </div>
  </div>
  </p>
  <p>I tried with &quot;secure&quot; in true, false, auto and all possibles combinations. And always had the same Chrome issue:</p>
  <blockquote>
  <p>In a future version of the browser, cookies marked with SameSite=None must also be marked with Secure to allow setting them in a cross-site context. This behavior protects user data from being sent over an insecure connection.
  Resolve this issue by updating the attributes of the cookie:
  Specify SameSite=None and Secure if the cookie is intended to be set in cross-site contexts. Note that only cookies sent over HTTPS may use the Secure attribute.
  Specify SameSite=Strict or SameSite=Lax if the cookie should not be set by cross-site requests</p>
  </blockquote>
  <p>Does anyone knows how to solve it?</p>
  <p>Thank you very much.</p>