i have deployed my project which has diffrent backend and frontend on render

this are the backed server logs

Requested URL: https://speck-backend.onrender.com/speck/v1/auth/google/callback?code=4%2F0AeanS0Y9MzRku1G5K7wiLEfjOxZKfPGif0Fs3hA5wuXCwADGZuM7_zVxVFlGvTnkPiq4oQ&scope=email+profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+openid&authuser=1&prompt=none
{
  id: 39,
  email: 'research.npci@gmail.com',
  name: 'Research & Development',
  createdAt: 2024-11-11T08:00:15.079Z,
  updatedAt: 2024-11-11T08:00:15.079Z
}
setting cookie
token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjozOSwiZW1haWwiOiJyZXNlYXJjaC5ucGNpQGdtYWlsLmNvbSIsIm5hbWUiOiJSZXNlYXJjaCAmIERldmVsb3BtZW50IiwiY3JlYXRlZEF0IjoiMjAyNC0xMS0xMVQwODowMDoxNS4wNzlaIiwidXBkYXRlZEF0IjoiMjAyNC0xMS0xMVQwODowMDoxNS4wNzlaIn0sImlhdCI6MTczMTMxNDIxNCwiZXhwIjoxNzMxMzIxNDE0fQ.8j8wSk0pheOE0MTOV7S1KbdD_NqRJ3bfxtJgHrP7njM

code of backend

import express, { Router, Request, Response, NextFunction } from 'express';
import passport from 'passport'
import jwt from "jsonwebtoken";

export const authRouter: Router = express.Router();

authRouter.get(
    '/google',
    passport.authenticate('google', { scope: ['profile', 'email'] })
);

authRouter.get(
    '/google/callback',
    passport.authenticate('google', { failureRedirect: '/auth' }),
    (req: Request, res: Response) => {
        const fullUrl = req.protocol + '://' + req.get('host') + req.originalUrl;
        console.log("Requested URL:", fullUrl);

        try {
            console.log(req.user);

            const token = jwt.sign(
                { user: req.user },
                process.env.JWT_SECRET || '',
                { expiresIn: "2h" },
            );
            console.log("setting cookie");

            // res.cookie('jwtToken', token,
            //     {
            //         path: '/',
            //         // "domain" - The cookie belongs to the 'example.com' domain
            //         domain: process.env.REDIRECT_URL_FRONTEND || 'localhost',
            //         // "secure" - The cookie will be sent over HTTPS only
            //         secure: true,
            //         // "HttpOnly" - The cookie cannot be accessed by client-side scripts
            //         httpOnly: true,
            //         sameSite: 'none'
            //     }
            // );

            res.cookie('jwtToken', token, {
                httpOnly: true,
                secure: true,
                sameSite: 'none',
                maxAge: 24 * 60 * 60 * 1000,
                path: '/',
                // httpOnly: true,
                // secure: true,

                // sameSite: "none",
                // maxAge: 2 * 60 * 60 * 1000, // 2 hours
                // path: '/',
                // domain: process.env.NODE_ENV === 'production' ? process.env.REDIRECT_URL_FRONTEND : undefined
            });

            console.log("token", token);

            res.redirect(process.env.REDIRECT_URL_FRONTEND || '/');
        } catch (error) {
            console.log('Error in Google callback:', error);
            res.redirect('/auth?error=authentication_failed');
        }
    }
);

authRouter.get('/logout', function (req: Request, res: Response, next: NextFunction) {
    req.logout(function (err) {
        if (err) { return next(err); }
        res.clearCookie('jwtToken');
        req.session.destroy(function (err) {
            if (err) { return next(err); }
            res.redirect(process.env.REDIRECT_URL_FRONTEND || '/');
        });
    });
});

authRouter.post('/verify-token', (req, res, next) => {
    debugger;
    const token = req.body.token;
    console.log("token", token);


    if (!token) {
        return res.status(400).json({ valid: false, message: 'No token provided' });
    }

    try {
        jwt.verify(token, process.env.JWT_SECRET || '');
        res.json({ valid: true });
    } catch (error) {

        req.logout(function (err) {
            console.log("in logout fun");
            res.cookie('jwtToken', '');
            res.status(401).json({ valid: false, message: 'Invalid or expired token' });
        });
    }
});


this is main app.ts

// Library imports
// import morgan from 'morgan';
// import helmet from 'helmet';
import express from 'express';
import cors from 'cors';
import passport from 'passport';
import session from 'express-session';
require('dotenv').config();

// Local imports
import * as middlewares from './middlewares/middlewares';
import MessageResponse from './interfaces/MessageResponse';
import roadmaproute from './routes/roadmap.route';
import { authRouter } from './routes/auth.route'
import { useGoogleStrategy } from './configs/auth.config';
import { jwtAuth } from './middlewares/auth.middlewares';
import userRouter from './routes/user.route';
import { requireHTTPS } from './middlewares/middlewares';


const corsOptions = {
  origin: process.env.REDIRECT_URL_FRONTEND,
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization', 'Cookie'],
  exposedHeaders: ['Set-Cookie'],
  preflightContinue: false,
  optionsSuccessStatus: 204
};


const app = express();
app.use(cors(corsOptions));
app.use(requireHTTPS);
// app.use(morgan('dev'));
// app.use(helmet.crossOriginResourcePolicy({ policy: "cross-origin" }));
app.use(express.json());
app.set('trust proxy', 1);
app.use(session({
  secret: process.env.SESSION_SECRET || "your-secret-key",
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true, // Railway uses HTTPS
    httpOnly: true,
    sameSite: 'none', // Important for cross-origin requests
    maxAge: 24 * 60 * 60 * 1000, // 24 hours
    path: '/',
    // Don't set domain explicitly when using Railway
    // domain: undefined // Let the browser handle the domain
  },
  proxy: true
}));

app.use(passport.initialize());
app.use(passport.session());

app.use('/speck/v1/auth', authRouter)
app.get('/speck/v1/serverHealth', (req, res) => {
  res.status(200).send('Server is healthy');
});

useGoogleStrategy();

app.get<{}, MessageResponse>('/', jwtAuth, (req, res) => {
  res.json({
    message: '🦄🌈✨👋🌎🌍🌏✨🌈🦄',
  });
});

app.use('/speck/v1/roadmap', jwtAuth, roadmaproute);
app.use('/speck/v1/user', jwtAuth, userRouter);

app.use(middlewares.notFound);
app.use(middlewares.errorHandler);

export default app;



this is frontend code




const AuthPage = () => {
  return (
    <div className="flex grow flex-col justify-center gap-4 items-center pt-2 md:pt-6 lg:pt-10 w-full min-h-screen px-5">
      {/* <h1 className="scroll-m-20 text-4xl font-extrabold tracking-tight lg:text-5xl pb-5 max-w-sm text-center">
        Bite-Sized Learning to go
      </h1> */}
      <Card className="mx-auto max-w-sm px-10">
        <CardHeader className="flex grow flex-col justify-center text-center">
          <CardTitle className="text-2xl flex content-center justify-center">
            <div className="flex items-center gap-2 font-semibold">
              <AppIcon className="h-10 w-10" />
              <span className="text-2xl font-semibold">Speck</span>
            </div>
          </CardTitle>
          <CardDescription className="mt-0">
            Start your journey with Speck, the bite-sized learning platform.
          </CardDescription>
        </CardHeader>
        <CardContent className="flex grow flex-col justify-center">
          <Button variant="default" size="default">
            <a href={`${process.env.NEXT_PUBLIC_API}/speck/v1/auth/google`}>
              Sign in with Google
            </a>
          </Button>
        </CardContent>
      </Card>
    </div>
  );
};


this is working fine when i was running it on my localhost

but now after google oath sceen when i approve cookie is not setting