User agent based `sameSite` cookie value

Starting with July, Chrome in specific cases requires the sameSite property of cookies to be set to None. However some browsers like specific versions of Safari don’t support that value and automatically switch to Strict when None is sent. User agent sniffing is therefore necessary for deciding which value to send, which however isn’t possible with the current implementation of express-session.

Since I wouldn’t include the UA sniffing part into this library (neither did Microsoft with ASP.NET Core), would it be OK to add the functionality for sameSite to also accept a function (req) => string | boolean to set the value based on the incoming request?

[dougwilson]

The issue with this proposal, of course, is that you will need to go though all the modules on npm getting them to do this. I would suggest (if not already on npm) to create a module that will alter any existing set-cookie headers on the response just before they are sent, as a hook. When it sniffs the user agent is Safari, it would remove sameSite=None from the header. This solution would not require every npm module to add sameSite as a function or similar and require users to then add this sniffing logic there for everything that needs it 👍

[stephtr]

I just thought because basically everyone using sameSite: 'none' will run into that issue and I didn’t think about changing the set-cookie header by using a middleware. Anyway, thank you again for your help!