title: Cookie not set, even though it is in response headers. Using express-session cookies
body: <p><strong>Problem:</strong></p>
  <p>Trying to set the cookie on login using <code>express-session</code>, but think I'm missing something obvious. The response to the login POST request includes Set-Cookie. I've also set the <code>Access-Control-Allow-Origin</code> and <code>Access-Control-Allow-Headers</code> to wildcards as shown here:
  <a href="https://i.stack.imgur.com/XS0Zv.png" rel="nofollow noreferrer">https://i.stack.imgur.com/XS0Zv.png</a></p>
  <p>But we see that in the browser storage (tried with Firefox and Chrome) there is nothing. <a href="https://i.stack.imgur.com/aemx7.png" rel="nofollow noreferrer">As shown here</a></p>
  <p>I'm currently setting my express-session as follows (refer to end of post for full code. Adding snippet for easier read):</p>
  <pre><code>app.use(session({
          genid: () =&gt; { return uuidv4(); },
          store: new MongoStore({ mongooseConnection: mongoose.connection }),
          secret: process.env.SESSION_SECRET,
          resave: false,
          saveUninitialized: true,
          cookie: {
            httpOnly: true,
            secure: false,
            sameSite: true,
          }
        })
      );
  </code></pre>
  <p>Then after I've verified the user is getting logged in, I try to set the userId via:</p>
  <pre><code>req.session.userId = user.id;
  </code></pre>
  <p><strong>Possibly Relevant Info</strong></p>
  <ul>
  <li>These sessions are successfully getting stored in Mongo as you can see <a href="https://i.stack.imgur.com/klLjN.png" rel="nofollow noreferrer">here</a>, which makes me believe that I'm at least generating the sessions correctly. Now I could be totally wrong here...</li>
  <li>my backend is running on <code>localhost:8000</code> via: <code>app.listen(8000);</code></li>
  <li>my client is running on <code>http://localhost:3000/</code></li>
  <li>trying not to use Apollo GraphQL for learning purposes</li>
  </ul>
  <p><strong>Things I've tried so far:</strong></p>
  <ul>
  <li>different combinatons of <code>resave</code>, <code>saveUnitialized</code>.</li>
  <li>remove the  <code>cookie</code> parameter.</li>
  <li>stop setting userId</li>
  <li>restarting browser and servers</li>
  <li>Looked at relevant stack overflow posts</li>
  </ul>
  <p>Please advise! Even ideas on how to debug this or what other things I can look at would be immensely helpful!</p>
  <p><strong>Relevant Code</strong></p>
  <p>app.js</p>
  <pre><code>const express = require('express');
  const { graphqlHTTP } = require('express-graphql');
  const mongoose = require('mongoose');
  const session = require('express-session');
  const MongoStore = require('connect-mongo')(session);
  const {v4: uuidv4} = require('uuid');
  
  const graphqlSchema = require('./graphql/schema/index');
  const graphqlResolvers = require('./graphql/resolvers/index'); 
  
  const app = express();
  const path = '/graphql';
  
  app.use(bodyParser.json());
  
  app.use((req, res, next) =&gt; {
    res.setHeader('Access-Control-Allow-Origin', '*');
    res.setHeader('Access-Control-Allow-Methods', 'POST,GET,OPTIONS');
    res.setHeader('Access-Control-Allow-Headers', '*');
    if (req.method === 'OPTIONS') {
      return res.sendStatus(200);
    }
    next();
  });
  
  mongoose
    .connect(`mongodb+srv://${process.env.MONGO_USER}:${process.env.MONGO_PASSWORD}@cluster0.ccz92.mongodb.net/${process.env.MONGO_DB}?retryWrites=true&amp;w=majority`,
      { useNewUrlParser: true, useUnifiedTopology: true, useFindAndModify: false }
    )
    .then(() =&gt; {
      app.use(session({
          genid: () =&gt; { return uuidv4(); },
          store: new MongoStore({ mongooseConnection: mongoose.connection }),
          secret: process.env.SESSION_SECRET,
          resave: false,
          saveUninitialized: true,
          cookie: {
            httpOnly: true,
            secure: false,
            sameSite: true,
          }
        })
      );
      app.use(path, graphqlHTTP({
        schema: graphqlSchema,
        rootValue: graphqlResolvers,
        graphiql: true,
      }));
  
      app.listen(8000);
    })
    .catch(err =&gt; {
      console.log(err);
    });
  </code></pre>
  <p>graphql/resolvers/auth.js</p>
  <pre><code>const argon2 = require('argon2');
  const jwt = require('jsonwebtoken');
  
  const User = require('../../models/user');
  
  module.exports = {
    createUser: async args =&gt; {
      try {
        const existingUser = await User.findOne({
          email: args.userInput.email
        });
        if (existingUser) {
          throw new Error('User exists already.');
        }
        const hashedPassword = await argon2.hash(
          args.userInput.password,
          12
        );
        const user = new User({
          email: args.userInput.email,
          password: hashedPassword,
          loggedIn: true
        });
        const result = await user.save();
        const token = jwt.sign(
          { userId: result.id, email: result.email },
          process.env.JWT_KEY,
          { expiresIn: '1h' }
        );
        return {
          userId: result.id,
          token: token,
          tokenExpiration: 1
        };
      } catch (err) {
        console.log(&quot;error in resolvers/auth.js&quot;);
        throw err;
      }
    },
    login: async (args, req) =&gt; {
      const { userId } = req.session;
      if (userId) {
        console.log(&quot;found req.session&quot;);
        return User.findOne({ _id: userId });
      }
      console.log(&quot;looking for user with &quot;, args.userInput.email);
      const user = await User.findOne({ email: args.userInput.email });
      console.log(&quot;found user&quot;);
      if (!user) {
        throw new Error(&quot;User does not exist!&quot;);
      }
      user.loggedIn = true;
      user.save();
      const isEqual = await argon2.verify(user.password, args.userInput.password);
      if (!isEqual) {
        throw new Error (&quot;Password is incorrect!&quot;);
      }
      console.log(&quot;setting session.userId&quot;);
      req.session.userId = user.id;
      return { ...user._doc, password: null};
    },
    logout: async (args, req) =&gt; {
      if (!req.isAuth) {
        throw new Error('Unauthenticated');
      }
      try {
        const result = await User.findOneAndUpdate(
          { _id: req.userId },
          { loggedIn: false },
          { new: true },
        );
        return { ...result._doc, password: null };
      } catch (err) {
        console.log(&quot;logout error&quot;, err);
        throw(err);
      }
    },
  };
  </code></pre>