Context:
- Trying to login, the request is working with success login. But for storing refreshToken, the cookie is not being set in Cookies section and not found.
- Backend sends set-cookie header with values but it doesn’t store cookie in browser.
Note: – I have mentioned below TECH STACK USED, CODE and REQUEST AND RESPONSE HEADER
Backend Code:
CORS:
cors: {
origin: 'https://dev.agent.example.in',
methods: 'GET,HEAD,PUT,PATCH,POST,DELETE,HEAD,OPTIONS',
preflightContinue: false,
optionsSuccessStatus: 204,
maxAge: 86400,
credentials: true,
}
Set Cookie:
response.cookie("refreshToken", refreshToken, {
httpOnly: true,
secure: true,
sameSite: 'none',
path: '/',
});
Frontend code:
axios.get('https://dev.api.example.com/data', {
withCredentials: true
});
Update: I tried cookie options domain: example.in, still not working
- Frontend uses axios
Environment: Https
Backend:
Tech:Loopback 4,TypeScript
API URL: https://dev.api.example.in/api/v1/ (EXAMPLE)
Frontend:
Tech:Next JS, Axios, TypeScript
URL: https://dev.ui.example.in (EXAMPLE)
RESPONSE Headers
HTTP/2 200
server: openresty
date: Thu, 28 Aug 2025 07:30:29 GMT
content-type: application/json
content-length: 342
x-powered-by: Express
access-control-allow-origin: https://dev.ui.example.in
vary: Origin
access-control-allow-credentials: true
set-cookie: refreshToken=<value of refreshToken>; Path=/; HttpOnly; Secure; SameSite=None
x-served-by: dev.api.example.in
X-Firefox-Spdy: h2
REQUEST Headers:
POST /api/v1/users/login HTTP/2
Host: dev.api.example.in
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br, zstd
Content-Type: application/json
Content-Length: 63
Origin: https://dev.ui.example.in/
Sec-GPC: 1
Connection: keep-alive
Referer: https://dev.ui.example.in/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Priority: u=0
TE: trailers
