title: Session cookie set `SameSite=None; Secure;` does not work
body: <p>I added SameSite=None; Secure; to set-cookie. but the cookie was not set and I can’t log in to my site.</p>
  <pre><code>response.writeHead(200, {
    'Content-Type': 'application/json',
    'Set-Cookie': 'token=' + token + '; SameSite=None; Secure; Expires=' + time.toUTCString() + '; Path=/' + '; Domain=' + hostname,
    'csrf-token': csrfToken
  });
  </code></pre>
  <p>I reviewed the cookie in developer tools under Application&gt;Storage&gt;Cookies and see more details. it showed a warning message:</p>
  <blockquote>
  <p>this set-cookie was blocked because it was not sent over a secure connection</p>
  </blockquote>
  <p>chrome blockes cookies, Because I work on the development environment and i send http request. But this test on Firefox browser logs in correctly.<br />
  I put the word <strong>secure</strong> inside the cookie and it worked properly, but because the word <strong>secure</strong> must be used next to <strong>samesite = none</strong> for <strong>cross-origin</strong>, otherwise the cookie will be blocked.<br />
  My question is why when I use <strong>secure</strong>, only the Chrome browser blocks the cookie, but it is true in other browsers.
  And that if I do not use <strong>secure</strong> I can not test the payment gateway because it blocks Chrome cross-orign if I do not use secure...</p>