title: Debugging CORS requests which fail to set cookies even with CORS headers and withCredentials=true
body: <p>There are many questions on StackOverflow of users making a CORS request which doesn't properly set cookies. I'm having the same problem, but I'm wondering if Chrome or another browser provides a method to diagnose and understand why the cookies aren't set. </p>
  
  <p>I'm finding all kinds of things that can cause this: missing CORS headers, missing <code>withCredentails=true</code>, situations across https secure boundaries, certain flags on the cookies... I want to understand what Chrome is doing instead of just guessing why it doesn't work.</p>
  
  <hr>
  
  <p>Here's my specific problem, but really I'm after a process to understand not just the fix.</p>
  
  <h3>Domain Creating Request:</h3>
  
  <p>Note withCredentails = true.</p>
  
  <pre><code>var xmlhttp = new XMLHttpRequest();
  xmlhttp.onreadystatechange = function() {
    if (xmlhttp.readyState === XMLHttpRequest.DONE) {
      callback(xmlhttp);
    }
  };
  xmlhttp.open('POST', url, true);
  xmlhttp.withCredentials = true;
  xmlhttp.setRequestHeader('Content-Type', 'application/json');
  xmlhttp.send(payload);
  </code></pre>
  
  <h3>Request:</h3>
  
  <p>Notice that Chrome doesn't show any Set-Cookie headers for the request.
  <a href="https://i.stack.imgur.com/dT6DE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/dT6DE.png" alt="enter image description here"></a></p>
  
  <h3>Curl of same request:</h3>
  
  <p>But if I right-click > copy > cUrl and execute here are the raw headers include Set-Cookie:</p>
  
  <pre><code>curl 'http://satellite:6988/medic/login' -H 'Referer: http://upstream:5988/medic/login?redirect=http%3A%2F%2Fupstream%3A5988%2Fmedic%2F_design%2Fmedic%2F_rewrite%2F%23%2Fmessages%2Fcontact%3A13863168-be61-418a-aea1-1b19b9a5af39' -H 'Origin: http://upstream:5988' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36' -H 'Content-Type: text/plain;charset=UTF-8' --data-binary '{"user":"worker","password":"dSNH1sv2jzdB"}' --compressed -v
  *   Trying 127.0.0.1...
  * TCP_NODELAY set
  * Connected to satellite (127.0.0.1) port 6988 (#0)
  &gt; POST /medic/login HTTP/1.1
  &gt; Host: satellite:6988
  &gt; Accept: */*
  &gt; Accept-Encoding: deflate, gzip
  &gt; Referer: http://upstream:5988/medic/login?redirect=http%3A%2F%2Fupstream%3A5988%2Fmedic%2F_design%2Fmedic%2F_rewrite%2F%23%2Fmessages%2Fcontact%3A13863168-be61-418a-aea1-1b19b9a5af39
  &gt; Origin: http://upstream:5988
  &gt; User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36
  &gt; Content-Type: text/plain;charset=UTF-8
  &gt; Content-Length: 43
  &gt; 
  * upload completely sent off: 43 out of 43 bytes
  &lt; HTTP/1.1 200 OK
  &lt; X-Powered-By: Express
  &lt; Access-Control-Allow-Origin: http://upstream:5988
  &lt; Vary: Origin, Accept-Encoding
  &lt; Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS, HEAD, DELETE
  &lt; Access-Control-Allow-Headers: accept, authorization, content-type, origin, referer, x-csrf-token
  &lt; Access-Control-Allow-Credentials: true
  &lt; Set-Cookie: AuthSession=d29ya2VyOjVDMDdEMjgwOj06hJxoYrYGtUxNa3ImYd1AZ7Vw; Path=/
  &lt; Set-Cookie: userCtx=%7B%22name%22%3A%22worker%22%2C%22roles%22%3A%5B%22chv%22%5D%7D; Max-Age=31536000; Path=/; Expires=Thu, 05 Dec 2019 13:28:32 GMT
  &lt; Set-Cookie: satelliteServer=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
  &lt; Content-Type: application/json; charset=utf-8
  &lt; Content-Length: 16
  &lt; ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
  &lt; Date: Wed, 05 Dec 2018 13:28:32 GMT
  &lt; Connection: keep-alive
  &lt; 
  * Connection #0 to host satellite left intact
  {"success":true}
  </code></pre>