title: Can't set cookie for api route laravel
body: <p>Doing an service with backend (laravel) and frontend SPA (vue.js, vue-cli 3). I need to make an auth via httpOnly cookie (not localStorage). I use <a href="https://github.com/tymondesigns/jwt-auth" rel="nofollow noreferrer">tymondesigns/jwt-auth</a> as api auth package. </p>
  
  <p>My environment is:</p>
  
  <ul>
  <li>API route: <code>http://brideplanner.test/api</code></li>
  <li>SPA route: <code>http://app-test.brideplanner.test:81/</code></li>
  </ul>
  
  <p>My login route is <code>/api/auth/login</code>, controller method is:</p>
  
  <pre><code>public function login()
      {
          $credentials = request(['email', 'password']);
          $user = User::where('email','=',$credentials['email'])-&gt;first();
          if (!$user || !$token = auth()-&gt;claims(['sub' =&gt; $user-&gt;id, 'csrf-token' =&gt; str_random(32) ])-&gt;attempt($credentials)) {
              return response()-&gt;json(['error' =&gt; 'Unauthorized'], 401);
          }
          return response()
              -&gt;json('success')
              -&gt;withCookie('token', $token, config('jwt.ttl'), ".brideplanner.test", null, false, false);
      }
  </code></pre>
  
  <p>But when I try to send an request to the API, there's no <code>token</code> item in the cookie storage. What's wrong here? Why there's no token? What should I do?</p>
  
  <p><strong>UPD:</strong> I tested the request via postman and I got the token: </p>
  
  <pre><code>Set-Cookie →token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC9icmlkZXBsYW5uZXIudGVzdFwvYXBpXC9hdXRoXC9sb2dpbiIsImlhdCI6MTU1MTM5NDMwNCwiZXhwIjoxNTUxMzk1MjA0LCJuYmYiOjE1NTEzOTQzMDQsImp0aSI6Im9uU1NtWEpSU0prR3NKc3giLCJzdWIiOjEsInBydiI6Ijg3ZTBhZjFlZjlmZDE1ODEyZmRlYzk3MTUzYTE0ZTBiMDQ3NTQ2YWEiLCIwIjoic3ViIiwiMSI6ImNzcmYtdG9rZW4iLCJjc3JmLXRva2VuIjoiTE9jSDFCWG9ITFJBMjlFYTg2MG1XQXhrVnpTR2gzT2oifQ.mnR4C6bwMIVptU64eZ6tN-gCYyFEuCIk_dm6dJsXrLY; expires=Thu, 28-Feb-2019 23:06:44 GMT; Max-Age=900; path=.brideplanner.test; domain=.brideplanner.test; httponly
  </code></pre>
  
  <p>But when I send the request from my SPA (<code>http://app-test.brideplanner.test:81/</code>), it goes wrong.</p>