I am deploying this code to render.com and used sameSite: none and secure: true but no cookie is set in browser and no Set-Cookie header is present in response header. funny thing is when I use sameSite: lax , cookie is temporarly set in browser and it warns me to use sameSite: none . in dev mode everything is ok and I set no sameSite or secure because it is no https. also in response header detector middleware I get no header details printed about response cookie in production mode. here is the entire code: I must note that I trigger sessions by req.session.loggedIn = true after a successful login. session is saved to db every time but not sent to browser. also, when i explicitly use res.cookie(...) it works and a cookie with sameSite: none and secure: true can actually be set in browser. prod is a boolean set to true and frontServer is exact url of client side. app.use((req, res, next) => { res.setHeader( Access-Control-Allow-Origin , frontServer);//api accessible only via our own client res.setHeader( Access-Control-Allow-Methods , GET,POST,PATCH,DELETE,PUT ); res.setHeader( Access-Control-Allow-Headers , Content-Type, Cookie, x-a-custom-field ); res.setHeader( Access-Control-Allow-Credentials , true ); // necessary to Allow sending cookies next(); }); const SequelizeStore = require( connect-session-sequelize )(session.Store) app.use(session({ store: new SequelizeStore({ db: sequelize, tableName: sessions , // Optionally specify a table name // secret: process.env.db_encrypt, }), secret: process.env.cookie_encrypt, // A strong, unique secret for session signing resave: false, // Don t save sessions that haven t changed saveUninitialized: false, // Don t create sessions for every client (it can do even w/o setting a custom req.session field) cookie: { ...(prod ? { sameSite: none } : {}), httpOnly: true, secure: prod, // Set to true if using HTTPS only maxAge: 1000 * 60 * 60 * 24 // 24 hours in milliseconds } })) app.use((req, res, next) => {// PRINTS NOTHING!! // Add a finish event listener to inspect the Set-Cookie header //console.log(36363, in set-cookie header ); res.on( finish , () => { const cookies = res.getHeaders()[ set-cookie ]; if (cookies) { console.log( Set-Cookie headers: , cookies); } }); next(); });