Session getting added to DB, but not to cookie, when set to SameSiteNone, but works in SameSiteLax

[spa5k]

session manager -

func SessionManager() *scs.SessionManager {
	once.Do(func() {
		Manager = scs.New()
		Manager.Lifetime = 24 * time.Hour
		Manager.Cookie.Persist = true
		Manager.Cookie.SameSite = http.SameSiteNoneMode
		Manager.Cookie.Path = "" // Empty string to allow for all localhost sites
		Manager.Cookie.HttpOnly = true
		//Manager.Cookie.Name = "session_id"
		//Manager.Cookie.Domain = ""

		Manager.Store = pgxstore.NewWithCleanupInterval(GetPool(), time.Minute*30)
		//osEnv := os.Getenv("ENV")
		//if osEnv == "production" {
		//	Manager.Cookie.Secure = true // Set to true when serving over HTTPS
		//}
	})
	return Manager
}

Auth -

func (p *GithubProvider) Callback(w http.ResponseWriter, r *http.Request) {
	err := helpers.ValidateStateAndCookieState(w, r)
	if err != nil {
		...
	}
	code := r.URL.Query().Get("code")
	token, err := helpers.ExchangeCodeForToken(r, code, p.OAuthConfig)
	if err != nil {
		...
	}

	client := p.OAuthConfig.Client(r.Context(), token)
	email, err := helpers.GetUserMainEmail(client)
	if err != nil {
		...
	}
........

	db.SessionManager().Put(r.Context(), "userId", user.ID)
	println("Redirecting to review ui", "userId", user.ID)

	redirectURL, err := url.Parse(config.Configuration.Services.ReviewUIService)
	if err != nil {
		....
	}
	logger.Info("Response headers", "headers", w.Header())

	http.Redirect(w, r, redirectURL.String()+"/auth", http.StatusFound)
}

This is weird error, i've been trying to create cookie with session, but for some reason, it does not add anything to the cookie.

sample log -

githubAuth      handlers/github.go:179  Response headers        {"headers": {"Set-Cookie":["state=da4e707a-9eb3-407b-baac-d16bbe7cc597; Max-Age=0"],"Vary":["Cookie"]}}

[spa5k]

But when I set the cookie to - Manager.Cookie.SameSite = http.SameSiteLaxMode, it starts working.

[spa5k]

Fixed it, according to latest changes in 2020, SameSite none also requires Secure to be enabled.

https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain