index.js

var session = require('express-session')
var express = require('express')
var Cookies = require( "cookies" )
var app = express()

app.set('trust proxy', 1) // trust first proxy

app.use(session({
  secret: 'keyboard cat',
  resave: false,
  saveUninitialized: true,
  cookie: { secure: false, domain: '.insly.test'}
}))

app.use(express.static('public'));

app.get('/', function (req, res, next) {
  if (req.session.views) {
    req.session.views++
    res.setHeader('Content-Type', 'text/html')
    res.header('Access-Control-Allow-Methods', 'POST, GET, PUT, DELETE, OPTIONS')
    res.header("Access-Control-Allow-Origin", "http://test.insly.test:3000");
    res.header("Access-Control-Allow-Credentials", 'true');
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");

    res.write('<p>views: ' + req.session.views + '</p>')
    res.write('<p>expires in: ' + (req.session.cookie.maxAge / 1000) + 's</p>')
    res.write('<script src="/js/main.js"></script>')
    res.end()
  } else {
    req.session.views = 1
    res.end('welcome to the session demo. refresh!')
  }
})

app.listen(3000, function () {
  console.log('Example app listening on port 3000!');
});

main.js

window.onload = function() {
  console.log('Hello World!');

  var xhr = new XMLHttpRequest();
  xhr.open("GET", 'http://random1.insly.test:3000', true);
  xhr.withCredentials = true;
  xhr.send();
};

package.json

{
  "name": "nodetest",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "dependencies": {
    "cookie-session": "^2.0.0-beta.3",
    "express": "^4.16.3",
    "express-session": "^1.15.6"
  },
  "devDependencies": {},
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC"
}