Cookie from a different source

Question

Given the following resolver for a mutation:

    async signin(parent, { name, password }, ctx, info) {
    // Check if there is a user with the name
    const user = await ctx.db.query.user({
        where: { name }
    })
    if (!user) {
        throw new Error('Name not found');
    }

    // Check if the password is correct
    const valid = await bcrypt.compare(password, user.password);
    if (!valid) {
        throw new Error('Invalid password');
    }

    // Genereate the JWT
    const token = jwt.sign({ userId: user.id }, process.env.APP_SECRET);

    // Set the cookie with the token
    ctx.response.cookie('token', token, {
        httpOnly: true,
        // secure: ...,
        // sameSite: ...,
        maxAge: 1000 * 60 * 60 * 24 * 365
    });

    return user;
}

When the code is like this, I get the following warning:

A cookie associated with a cross-site resource at http://timetable-yoga-pd.herokuapp.com/ was set without the SameSite attribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set with SameSite=None and Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

Backstory: the frontend part is a React app, that is hosted on timetable-react-pd.herokuapp.com. The backend part is a node app, hosted on timetable-yoga-pd.herokuapp.com.

Now, when I set the secure to true, as asked in the warning, the cookie header is not set. I have found on the internet, that this is normal.

When I set sameSite to false, it acts as if it were not there (expected behaviour). If sameSite is set to "none" or "None", the warning disappears, but a new error emerges, saying that GraphQL does not accept the value "none".