Question: I am using cookie-session and passportjs to authenticate users in my express app. When I initialize my cookieSession like this:

```
app.use(cookieSession({
    maxAge: 24 * 60 * 60 * 1000,
    keys: ['key1']
}));

```

my cookie is successfully saved to the client. However, the project I am working on requires cross-site requests. Therefore, the secure attribute for the cookie must be set to true and the SameSite attribute must be set to none. In the documentation, these values are able to be set as follows:

```
app.use(cookieSession({
    maxAge: 24 * 60 * 60 * 1000,
    secure: true,
    sameSite: 'none',
    keys: ['key1']
}));

```

however, when I do this, the cookie fails to save to the client. I'm wondering if anyone knows how to fix this or why this might be happening?

Thank you in advance.

Answer: 
The [answer by Luka Darsalia](https://stackoverflow.com/a/68090771/2441655) showed me that, in my case at least, the server was refusing to send `secure:true` cookies to the client, because it thought the client was insecure (due to the `request.protocol` being `http` rather than `https`).

At first I was confused by this, because my address-bar showed `https`. But then I remembered that the `https` was only for the connection between my browser and Cloudflare CDN -- the connection between Cloudflare CDN and my actual server was still using `http`.

Thus, to fix it, I simply had to assure [cookie-session](https://github.com/expressjs/cookie-session) (more specifically, [this line](https://github.com/pillarjs/cookies/blob/d2111627e8ff2e29f90e75d1f1cc4164c5a07a3f/index.js#L93) in the [cookies](https://github.com/pillarjs/cookies) package) that the connection was secure, and thus to go ahead with sending the cookie with the `secure:true` flag.

To do this, I simply added the following middleware after the `cookieSession` middleware:

```
// your existing cookieSession init here
app.use(cookieSession({
    [...]
    secure: true,
    sameSite: "none",
}));

// enable the "secure" flag on the sessionCookies object
app.use((req, res, next)=>{
    req["sessionCookies"].secure = true;
    next();
});

```
After authentication use this:

```
passport.authenticate("local");
   req.session.save((error) => {
     if (err) {
       console.log(err);
     } else {
       res.redirect("/");
      }
});

```