title: Post request sent with new cookie each time
body: <p>I want to store a user's role (i.e. admin or normal use) in an express session after they login. However, after logging in, a new cookie is sent with each request from the React front end. The express session is being stored in mongodb.</p>
  <p>My express endpoint for logging in. I tried to store a boolean in the session that indicated if a user is an admin.</p>
  <pre><code>router.post(&quot;/login&quot;, (req, res, next) =&gt; { 
  passport.authenticate(&quot;local&quot;, function(err, user, info) {
      console.log('user is', user)
  
      if (err) {
          console.log(err)
          return res.status(400).json({ errors: err });
      }
      if (!user) {
          console.log('no user fouund')
          return res.status(400).json({ errors: &quot;No user found&quot; });
      }
      req.logIn(user, function(err) {
          if (err) {
              console.log('user found, error')
              return res.status(400).json({ errors: err });
          }
          console.log(user.isAdmin, 'user is admin')
          if (user.isAdmin){
              req.session.isAdmin = true
          }
          return res.status(200).json({ success: `logged in ${user.id}` });
      });
  })(req, res, next)
  </code></pre>
  <p>})</p>
  <p>My request from the front end to login:</p>
  <pre><code>  const handleSubmit = async (event) =&gt; {
  event.preventDefault();
  const data = new FormData(event.currentTarget);
  const res = await fetch(API_URL + '/login', {
    method: 'POST',
    mode: 'cors',
    credentials: 'include',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      'phone_number': data.get('phone_number'),
      'password': data.get('password')
    })
  })
  console.log(res)
  </code></pre>
  <p>};</p>
  <p>My endpoint for checking whether a user is an admin. Whenever a request is made to this endpoint, the session does not even have an isAdmin variable in it. which makes this endpoint always return false. Weirdly, this endpoint behaves properly when I make the requests through postman, but not through the browser.</p>
  <pre><code>router.get(&quot;/isAdmin&quot;, function(req, res){
  console.log(req.session, 'is session')
  if (req.isAuthenticated()){
      console.log('admin found')
      res.send({
          isAdmin: true
      })
  } else {
      console.log(req.session)
  //This prints a session that dosnt even have an isAdmin variable. If I print the id instead, it prints one thats different from the endpoint above.
      res.send({
          isAdmin: false
      })
  }
  </code></pre>
  <p>My request from the frontend to check if the user is an admin. This is under a different component served by a different route in react-router if that's relevant.</p>
  <pre><code>  useEffect(() =&gt; {
      const checkAdmin = async () =&gt; {
        var res = await fetch(API_URL + '/isAdmin', {
          credentials: 'include',
        })
        res = res.json()
        console.log(res)
        setIsAdmin(res.isAdmin)
      }
      checkAdmin()
    })
  </code></pre>
  <p>Lastly, my express middleware:</p>
  <pre><code>const session = require('express-session');
  
  const app = express();
  app.use(cors({
      origin: 'http://127.0.0.1:3000',
      credentials: true
  }));
  app.use(bodyparser.json())
  app.use(bodyparser.urlencoded({
      extended:true
  }))
  
  app.use(
      session({
          secret: 'super secure secret',
          resave: false,
          saveUninitialized: false,
          store: MongoStore.create({mongoUrl: process.env.DB_URI}),
          cookie: {
              secure: false,
              httpOnly: false,
              sameSite: 'none',
          },
          isAdmin: false
      })
  )
  
  app.use(passport.initialize())
  app.use(passport.session())
  app.use('/', auth)
  </code></pre>
  <p>auth is the file that has the endpoints shown above.</p>
  <p>Steps I've tried:</p>
  <ul>
  <li>I've tried changing resave, saveUnitiliazed, secure, httpOnly and
  sameSite in the session settings.</li>
  <li>I've tried enabling third party
  cookies in chrome.</li>
  <li>I've tried accessing my react app through
  127.0.0.1:3000 and localhost:3000, and changing the cors middleware accordingly.</li>
  <li>I've tried using another library (ky) to make the fetch
  call.</li>
  </ul>
  <p>I've been tearing my hair out trying to fix this. Thanks in advance to anyone who might have an idea.</p>