title: NodeJS HTTPOnly cookie not being sent with fetch function
body: <p>I'm having problems with cookie authentication between an expressJS server and a VueJS font-end.</p>
  
  <p>When logging in through the site, I successfully get a HTTPOnly Cookie in the set-cookie header:
  <a href="https://i.stack.imgur.com/IQS5x.png" rel="nofollow noreferrer">Screenshot (Ignore the Auth header, using it for testing only)</a></p>
  
  <p>I also see the <a href="https://i.stack.imgur.com/YPjow.png" rel="nofollow noreferrer">cookie in the devTools</a>, and everything looks right too me, I'm not an expert on cookies though so it may not be correct</p>
  
  <p>The problem is when I request the user's settings on another endpoint, the cookie is not sent to the server. The <code>req.cookie</code> object is empty when the this request is handled on the server side.</p>
  
  <p>Here is my fetch code:</p>
  
  <pre><code>const loginOptions = {
    method: 'POST',
    mode: 'cors',
    cache: 'no-cache',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      email: email,
      password: password,
    }),
    credentials: 'same-origin',
  };
  
  const settingsOptions = {
    method: 'GET',
    mode: 'cors',
    cache: 'no-cache',
    headers: {
      'Content-Type': 'application/json',
    },
    credentials: 'same-origin',
  };
  
  const loginResponse = await fetch(baseUrl + '/login', loginOptions);
  const userSettings = await fetch(baseUrl + '/settings', settingsOptions);
  </code></pre>
  
  <p>I've tried using <code>credentials: "include"</code>, without success.</p>
  
  <p>On the express server I'm using cors like this:</p>
  
  <pre><code>app.use(cors({
      origin: '*',
      credentials: true,
  }));
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/kkJbE.png" rel="nofollow noreferrer">Here is also an example</a> of the second request, the <code>403</code> status is set by the server when no cookie is attached to the request.</p>
  
  <p>I've tried setting the domain of the cookie to both <code>localhost</code> and <code>127.0.0.1</code> as suggested in another thread. <a href="https://i.stack.imgur.com/O9Vjy.png" rel="nofollow noreferrer">I have left it on <code>localhost</code> for now</a>.</p>
  
  <h3>Solved</h3>
  
  <p>I had read somewhere that you should add a specific domain value to the cookie when creating it. If I just removed that setting, it sets it automatically I'm guessing, and then it worked! So my guess is that I had set the domain value to the wrong value for what I was trying to do</p>