Marked as helpful by the asker
cors() with no options answers Access-Control-Allow-Origin: *. Browsers refuse * for requests that carry cookies, on purpose: otherwise any website could make calls with your users' cookies.
Name the exact origin and allow credentials:
app.use(cors({
origin: 'https://myshop.netlify.app',
credentials: true,
}))And the session cookie needs SameSite=None; Secure, because netlify.app and replit.app are different sites.
Uninstall that browser extension; it hides the problem only for you.
it works!! also had to add sameSite none like you said. thank you moana_k
Heads up: Safari may still block that cookie since it's a third-party cookie. If iPhone users can't log in, that's why. felix_codes