socket.io sets cross-site cookie without same-site attribute

Question

I have a socket.io application and recently I got this warning:

A cookie associated with a cross-site resource at URL was set without the

Answer 1

As per the issue reported in Socket IOs' github repo, that cookie is not used for anything; you can disable it by setting cookie: false in the server options.

But what you have missed is setting {cookie: false} option when initializing the socket, not http.listen. The solution provided below worked for me that uses express as the server.

var server = require('http').createServer(express());
var io = require('socket.io')(server, { path:"/some/path", cookie: false });