title: Cookie not set when localhost web app accesses remote API
body: <p>I have a React web app served on <code>http://localhost:3000</code>.</p>
  <p>This web app accesses a remote API i.e. <code>https://app.example.com/api</code>.</p>
  <p>When performing a login on the API, the server returns a session Cookie like this one:</p>
  <pre><code>Set-Cookie: JSESSIONID=ZmQ2Yzg4OWYtYzdiNi00Mzc1LTkzMzUtYzhiZjZmM2MzZjMy; Domain=app.example.com; Path=/api/; Secure; HttpOnly; SameSite=Lax
  </code></pre>
  <p>However, on Chrome, the Set-Cookie doesn't appear in the list of response headers. Also, if I re send the same request, Chrome doesn't include the Cookie in the request headers.</p>
  <p>So, my understanding is that it ignores the Cookie. Why?</p>
  <p>Regarding CORS, I don't see any issue with it, and the request is sent correctly by Chrome. Here are the returned CORS headers in the preflight:</p>
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: content-type
  Access-Control-Allow-Methods: PATCH,GET,POST,PUT,DELETE
  Access-Control-Allow-Origin: http://localhost:3000
  Access-Control-Expose-Headers: ETag, X-XSRF-TOKEN
  </code></pre>
  <p>I tried adding a local DNS entry <code>app.me</code> pointig to <code>127.0.0.1</code> but still doesn't work.</p>
  <p>I also tried with Edge, and I can see the Set-Cookie header appearing, however, the cookie doesn't appear to be set too.</p>
  <hr />
  <p><strong>EDIT:</strong></p>
  <p>This it the Axios code:</p>
  <pre class="lang-js prettyprint-override"><code>const axios = require('axios');
  
  const backendUrl = 'https://app.example.com/api';
  const constructUrl = url =&gt; `${backendUrl}${url}`;
  
  const axiosConfig = {
    withCredentials: true,
  };
  
  export default {
    get: url =&gt; axios.get(constructUrl(url), axiosConfig),
    post: (url, data) =&gt; axios.post(constructUrl(url), data, axiosConfig),
    put: (url, data) =&gt; axios.put(constructUrl(url), data, axiosConfig),
    delete: (url, data) =&gt; axios.delete(constructUrl(url), data, axiosConfig),
  };
  
  //And in a different file...
  
  HttpService.post('/login', creds)
          .then((response) =&gt; {
            const userInfo = response.data;
            const token = response.headers['x-xsrf-token'];
            sessionStorage.setItem('user-info', JSON.stringify(userInfo));
            sessionStorage.setItem('user-xsrf-token', JSON.stringify(token));
  
            window.location.replace('/');
          })
          .catch((err) =&gt; {
            if (err.response.status === 401) {
              setLoginError('Bad cred');
            } else {
              setLoginError('Fail to auth');
            }
          });
  </code></pre>