My app is rendered in an iframe inside other application in sort of a widget.
A user can authenticate into that widget, and then my server will return samesite=none, partitioned:true session cookie.
But if afterwards the user visits my app not in the iframe they will need to relogin (because of partitioned).
To fix that I’d like my server to send 2 session cookies as a response for login request:
- one with
samesite,partitioned(for the iframe) - and one without (for regular app).
I have 2 questions here:
- Does express supports it (sending 2 cookies with the same name but different config)?
- And is it the right thing to do from the security perspective?