title: How to handle SameSite attribute in Express with incompatible clients?
body: <p>Chrome is changing the default value of <code>SameSite</code> cookie attribute from <code>None</code> to <code>Lax</code> as of its version 80. My site is embedded to another site using an iframe and the login session of my site is handled by <code>express-session</code>.</p>
  
  <p>For new browsers the solution is just to set the session cookie to <code>SameSite=None; Secure</code> which <code>express-session</code> already supports. However, some <a href="https://www.chromium.org/updates/same-site/incompatible-clients" rel="nofollow noreferrer">clients are incompatible</a> for the <code>SameSite</code> attribute and would stop working.</p>
  
  <p><a href="https://web.dev/samesite-cookie-recipes/" rel="nofollow noreferrer">One proposed solution</a> to the problem is to use two cookies, one for new clients and one for the old incompatible clients:</p>
  
  <pre><code>Set-cookie: session-id=value; SameSite=None; Secure
  Set-cookie: session-id-legacy=value; Secure
  </code></pre>
  
  <p>Is it possible to use the proposed two-cookie solution to the problem or is there a better way in <code>express-session</code> to also provide support to old incompatible browsers?</p>