1

So I built an app that uses passport and express session for its authentication. When I deployed, I discovered that safari was not letting express session work until I switched off 'cross site tracking' in its settings. How do I make this work?

Based on this article https://sarav.co/session-persisting-issue-safari I need to manually switch it off, but I honestly cannot expect my users to be manually doing that.

Below is how I've set up my express session:

app.set('trust proxy', 1);

app.use(session({
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: {
        secure: true,
        httpOnly: true,
        sameSite: 'none',
        maxAge: 60 * 60 * 24 * 1000
    },
    store: MongoStore.create({
        mongoUrl: process.env.DB_URL,
        ttl: 14 * 24 * 60 * 60,
        autoRemove: 'native',
    })
}));
Kotai
  • 121
  • 1
  • 7

0 Answers0