I'm trying to log into my production react app with the same credentials I used to log into my development react app. But logging into one, results in not being able to log into the other one simultaneously since I have put a validation on the back-end that prevents a user logging in from the same address(not different ones) twice if they're already logged in. The production one is one Netlify and the development one is on localhost.

I'm using express-session to store user data in a store with these configuration:

app.use(
  session({
    secret: process.env.SECRET,
    name: "pg.sessionId",
    saveUninitialized: false,
    resave: false,
    cookie: {
      maxAge: 1209600000, // 14 days
      httpOnly: true,
      secure: isProduction ? true : false,
      sameSite: isProduction ? "none" : "lax",
    },
    store: new pgSession({
      pool: db,
      createTableIfMissing: true,
    }),
  })
);

Everything was working fine until I changed the CORS Origin to allow multiple addresses to access it in this way:

// CORS
const cors = require("cors");
const options = {
  credentials: true,
  origin: isProduction
    ? [process.env.ADDRESS1, process.env.ADDRESS2, "http://localhost:3000"]
    : "*",
};

ADDRESS1 is the API Docs on Swagger

In the front-end, I have set the withCredentials of axios to true.

Why is this happening and how can I fix it?