title: Session-Cookie not sent in CORS environment
body: <p>I'm desperately trying to get session cookies to work in my environment, but without luck so far.</p>
  
  <p>My backend is a node/express application, running at port 3000. CORS is enabled like this:</p>
  
  <pre><code>const corsOptions = {
      origin: "http://127.0.0.1:4300",
      allowedHeaders: [ "Origin", "X-Requested-With", "Content-Type", "Accept", "Authorization", "x-xsrf-token" ],
      credentials: true
  };
  if (isDebug) {
      corsOptions.maxAge = 1;
  }
  app.use(cors(corsOptions));
  </code></pre>
  
  <p>I'm using express-session and passport for login. The session is configured like this:</p>
  
  <pre><code>const options = {
      secret: '...',
      cookie: { httpOnly: true }
  };
  
  app.use(session(options));
  </code></pre>
  
  <p>The frontend is an Angular 2 SPA, running at port 4300. When I'm serving the frontend from my express server, everything works as expected. But when not, I'm experiencing the following obscure problem:</p>
  
  <p>The login route returns a cookie with the session ID. But the next request to the backend is sent with a <em>different</em> session ID?! I have no idea, where this different session ID could come from. Especially since the session cookie is marked as HTTP-only.</p>
  
  <p>The HTTP-requests are sent as follows:</p>
  
  <pre><code>const response = this.http.get(url, { withCredentials: true });
  </code></pre>
  
  <p>I tried the following:</p>
  
  <ul>
  <li>Made sure that third party cookies are allowed in the browser => it was fine.</li>
  <li>Tried to set httpOnly to false => no luck.</li>
  <li>Experimented with cookie domain: set it to the address of the backend - no luck. Then to the address of the frontend - didn't work either.</li>
  <li>Cleared browser and cookie caches, tried out Google Chrome and Edge. Nothing helped.</li>
  </ul>
  
  <p>Does anybody have an idea which part of the puzzle is missing?</p>
  
  <p>Thanks a lot,
  Steven</p>