After developing an app that utilizes passport and express session for authentication, I encountered an issue when deploying it. Safari was not allowing express session to work until I disabled 'cross site tracking' in the browser's settings. How can I resolve this issue?
While following the instructions from this article , it seems that users would need to manually disable this setting, which is not ideal. Is there a better way to handle this?
Below is my current setup for express session:
app.set('trust proxy', 1);
app.use(session({
secret: process.env.SESSION_SECRET,
resave: false,
saveUninitialized: false,
cookie: {
secure: true,
httpOnly: true,
sameSite: 'none',
maxAge: 60 * 60 * 24 * 1000
},
store: MongoStore.create({
mongoUrl: process.env.DB_URL,
ttl: 14 * 24 * 60 * 60,
autoRemove: 'native',
})
}));