I’m making HttpOnly cookies for my authentication (server and client code below). But cookies are not placed in the storage, no matter how much I want and do not dodge. At the same time, there are no errors or warnings in the browser (if I set Samesite: Lax or Strict, the browser notices this and issues a warning)

server:

const corsOptions = {
  origin: [
    "https://3a25-185-9-186-241.ngrok-free.app",
    "http://localhost:9001",
  ],
  methods: ["GET", "POST"],
  allowedHeaders: ["Content-Type", "Authorization"],
  exposedHeaders: ["Set-Cookie"],
  credentials: true,
};

app.use(cors(corsOptions));

app.post("/api/auth/telegram", (req, res) => {
  const userData = req.body;

  if (!validateTelegramAuth(userData)) {
    console.log("Неверная подпись Telegram");
    return res.status(403).json({ message: "Неверная подпись Telegram" });
  }

  // Генерируем JWT токен
  const token = generateAuthToken(userData);

  res.cookie("authToken", token, {
    httpOnly: true,
    secure: true,
    sameSite: "None",
    partitioned: true,
    maxAge: 7 * 24 * 60 * 60 * 1000,
  });

  res.cookie("user", userData, {
    httpOnly: true,
    secure: true,
    sameSite: "None",
    partitioned: true,
    maxAge: 7 * 24 * 60 * 60 * 1000,
  });

  console.log("Токен сгенерирован и отправлен:", token);
  console.log("Куки отправлены:", res.getHeaders()["set-cookie"]);
  return res.json({ token });
});

Client:

    window.onTelegramAuth = async (user) => {
      try {
        const response = await fetch("https://localhost:5000/api/auth/telegram", {
          method: "POST",
          headers: {
            "Content-Type": "application/json",
          },
          body: JSON.stringify(user),
          credentials: "include",
        });

        if (!response.ok) {
          throw new Error("Ошибка авторизации");
        }

        console.log(response)

        const userData = await response.json();


        setUser(userData);
      } catch (error) {
        console.error("Ошибка авторизации:", error);
      }
    };

I checked the certificate, checked its expiration date, added it to my browser (because it is self-signed, therefore, by default, the browser blocks it – I added it to the browser, restarting the browser just in case), tried all possible values of SameSite, enabled and disabled secure.

Are there cookies in Network Devtools, all the flags, etc., that is, does the client receive cookies? But does not install them

enter image description here

enter image description here