How to Fix "SameSite=Lax" Cookie Stripped on Cross-Site POST, OAuth & Webhook Callbacks

1. Root Cause Analysis (Engine-Level Breakdown)

When modern JavaScript engines (V8 in Chrome/Node.js, JavaScriptCore in Safari, and SpiderMonkey in Firefox) encounter this failure condition, execution halts or falls back to degraded behavior due to the following primary triggers:

• Chrome and modern browsers default cookies to `SameSite=Lax`, which strips cookies on cross-site `POST` requests and iframe embeds.
• OAuth callbacks redirecting via POST instead of standard HTTP `GET` with state verification parameter.
• Setting `SameSite=None` without the mandatory `Secure` flag (rejected by modern browsers over HTTP).

In high-scale production systems, this error rarely occurs during local development because local environments lack network latency, third-party browser extensions, complex caching proxies, and production minification transforms that uncover timing race conditions.

2. Verified Production Solutions

The following code recipes provide immediate and architectural fixes for this error:

// Production Express.js Cookie Configuration for Cross-Site OAuth / Embedded Contexts:
import session from 'express-session';

app.use(session({
  name: 'remoat_session',
  secret: process.env.SESSION_SECRET || 'secret-key',
  resave: false,
  saveUninitialized: false,
  cookie: {
    // CRITICAL: SameSite=None requires Secure: true (HTTPS only)
    sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax',
    secure: process.env.NODE_ENV === 'production',
    httpOnly: true,
    maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
    domain: process.env.COOKIE_DOMAIN || undefined,
  },
}));

// If handling cross-site OAuth callbacks, ensure redirect uses GET:
app.get('/auth/callback', (req, res) => {
  // Session cookie is automatically sent on top-level GET navigation under SameSite=Lax
  res.redirect('/dashboard');
});

3. Step-by-Step Resolution Workflow

Follow this structured checklist to resolve and prevent this error in your CI/CD pipeline: