title: Cors - This set-cookie domain attribute was invalid with regards to the current host url
body: <p>I have a node backend, which should allow cross origin request from my frontend application that is running on localhost:3000. Therefore I've restricted the cors policy to my domain.</p>
  
  <pre><code>import csrf from 'csurf';
  
  app.use(
    cors({
      origin: 'http://localhost:3000',
      credentials: true
    })
  );
  
  const csrfProtection = csrf({
    cookie: {
      maxAge: 900,
      domain: 'http://localhost:3000'
    }
  })
  
  router.get('/csrfToken', csrfProtection, async (req, res, next) =&gt; {
    res.json({ token: req.csrfToken() });
  });
  </code></pre>
  
  <p>When I'm making now a request to my server endpoint (which is running on localhost:5000), it returns me the following error that the cookie cannot be set.</p>
  
  <pre><code>  fetch('http://localhost:5000/csrfToken', {
        method: 'GET',
        credentials: 'include'
   })
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/Z37Ug.png" rel="noreferrer"><img src="https://i.stack.imgur.com/Z37Ug.png" alt="enter image description here"></a>
  <a href="https://i.stack.imgur.com/0cNWv.png" rel="noreferrer"><img src="https://i.stack.imgur.com/0cNWv.png" alt="enter image description here"></a></p>