I have a problem with my Node application using Express.js, Socket.io and they both share the same session ID. If I open my website without iframe or iframe with same origins, it works perfectly fine (same session ID sharing between HTTP and Socket.io). However, the shared session ID between Express.js and Socket.io doesn't work when it runs under iframe with different origins (parent and child). I don't see the cookie set into Chrome browser under dev tools.

Both origins are non-secure HTTP website (e.g. http://ip.ad.dr.ess/ (parent) to http://ip.ad.dr.ess:6175/ (child)). I access my website directly without going through any web server because I publish my node backend with this port 6175.

Here's the sample code:

Set up express-session:

const sessionMiddleware = session({
  resave: true,
  saveUninitialized: true,
  secret: config.session.secretKey,
  httpOnly: true,  // dont let browser javascript access cookie ever
  ephemeral: true, // delete this cookie while browser close
  cookie: { maxAge: config.session.maxAge, secure: false, sameSite: "none", path: "/" },
  store: new (FileStore(session))({
    logFn: logger.info,
    reapInterval: config.session.reapInterval,
  })
});

app.use(sessionMiddleware);

Set up additional middleware for Express.js:

app.use(cors());
app.options('*', cors());
app.use(helmet({ frameguard: false }));
app.use(compression());
app.use(bodyParser.json());
app.use(cookieParser());

Set up Socket.io with express-session package:

this.io = new Server(server, {
   cors: {
      origin: '*',
      methods: ["GET", "POST", "PUT", "DELETE"],
   },
});

this.socket.io.use((socket, next) => {
   sessionMiddleware(socket.handshake, {}, next);
});