NodeJs + Passport. Cookie persistence in Windows vs MacOS - node.js

Question

I'm using PassportJS and NodeJS as backend for a website server. It uses the Passport-Local strategy. I develop the website in a MacOSX environment.
The server serves pages for information about our company and our commercial product.
It also serves help files (HTML web help) generated using Help and Manual.
The software that we sell runs on Windows and is programmed in Delphi VCL. We set it up so that it will redirect to our web help when pressing F1 using contextual ids like such :
procedure MyForm.OnHelp(blabla)
begin
ShellExecute( blabla, www.mywebsite.com/secure/help?contextid=202383)
end
All paths in www.mywebsite.com/secure are secure, and will require authentication with the passport.js middleware.
This is the relevant routing / passport configuration.
// CHECK AUTH METHOD
function ensureAuthenticated(req, res, next) {
if (req.isAuthenticated()) {
return next();
}
req.session.target = req.originalUrl;
req.session.save(function (err) {
res.redirect('/login')
});
}
// PASSPORT LOGIN STRATEGY
passport.use(
new passportLocal.Strategy({
usernameField: "username",
passwordField: "password"
},
function (email, password, done) {
if (!email) {
return done(null, false);
}
if (!password) {
return done(null, false);
}
if (password.toLowerCase() === 'ASTUPIDPASSWORD') {
return done(null, {email: email});
} else {
return done(null, false);
}
}
));
// PASSPORT SERIALIZE
passport.serializeUser(function (user, done) {
done(null, user.email);
});
// PASSPORT DESERIALIZE
passport.deserializeUser(function (email, done) {
done(null, {email: email});
});
// OTHER AMAZING ROUTES
router.use('/secure', ensureAuthenticated);
router.get('/secure/help', function (req, res) {
res.redirect('/secure/help/index.html');
});
This is the express configuration
var express = require('express');
var path = require('path');
var favicon = require('serve-favicon');
var logger = require('morgan');
var cookieParser = require('cookie-parser');
var bodyParser = require('body-parser');
var compression = require('compression');
var fs = require('fs');
var passport = require('passport');
var session = require('express-session');
var app = express();
// view engine setup
app.set('views', path.join(__dirname, 'client', 'views'));
app.set('view engine', 'jade');
app.use(compression());
app.use(favicon(__dirname + '/client/images/favicon.png'));
app.use(logger('dev'));
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended: true})); //
app.use(cookieParser());
app.use(require('less-middleware')(path.join(__dirname, 'client')));
app.use(express.static(path.join(__dirname, 'client')));
app.use(session({
saveUninitialized : true,
resave : false,///
secret: 'adamngoodsecret
}));
app.use(passport.initialize());
app.use(passport.session());
var routes = require('./routes/index');
app.use('/', routes);
When I develop in the MacOSX environment, I will login once. Then, I will be able to return to the secure zone because I guess I will have a cookie set up, regardless if I'm using safari or chrome.
Though, when I test it in a Windows environment, the problem occurs.
I open the broswer, type in www.mywebsite.com/secure/help?blabla
I am asked for login. OK
I enter login. OK
I am redirected to the initial requested url. OK
I close the tab WITHOUT CLOSING THE BROWSER. OK
I request the www.mywebsite.com/secure/help?blabla URL. OK
I can access the resource. OK
I close the browser. OK.
I open a new broser window. OK.
I request the www.mywebsite.com/secure/help?blabla. OK
I get asked for credentials. FAIL
So, whenever I close the browser window (Safari, Chrome) in Windows 10 environment, I get asked for the credentials again.
In MacOSX, even if I close the browser, I do not get asked the credentials again.
It is very unconvenient for my users to have to enter their credentials each time on the Windows environment.
Can anyone point me in the right direction in order to solve this? It seems the cookies in the Windows 10 environment are reset whenever the browser window is closed, though I'm not sure.
Thanks.