title: Cookies when using separate Dyno for react frontend and Django backend
body: <p>I am building a simple web app using React.js for the frontend and Django for the server side.</p>
  
  <p>Thus <code>frontend.herokuapp.com</code> and <code>backend.herokuapp.com</code>.</p>
  
  <p>When I attempt to make calls to my API through the react app the cookie that was received from the API is not sent with the requests.</p>
  
  <p>I had expected that I would be able to support this configuration without having to do anything special since all server-side requests would (I thought) be made by the JS client app directly to the backend process with their authentication cookies attached.</p>
  
  <p>In an attempt to find a solution that I thought would work I attempted to set </p>
  
  <p><code>SESSION_COOKIE_DOMAIN = "herokuapp.com"</code></p>
  
  <p>Which while less than ideal (as herokuapp.com is a vast domain) in Production would seem to be quite safe as they would then be on api.myapp.com and www.myapp.com.</p>
  
  <p>However, with this value set in settings.py I get an <code>AuthStateMissing</code> when hitting my <code>/oauth/complete/linkedin-oauth2/</code> endpoint.</p>
  
  <p>Searching google for <code>AuthStateMissing SESSION_COOKIE_DOMAIN</code> yields one solitary result which implies that the issue was reported as a bug in Django social auth and has since been closed without further commentary.</p>
  
  <p>Any light anyone could throw would be very much appreciated.</p>