title: Sending cookie in XHR response but it's not getting stored?
body: <p>I'm trying to pass an <code>HttpOnly</code> cookie with a response from an API I'm writing. The purpose is for the cookie act like a refresh token for the purpose of <a href="https://www.google.com/search?q=silent%20refresh%20definition&amp;oq=silent%20refresh%20def&amp;aqs=chrome.1.69i57j33.3669j0j4&amp;sourceid=chrome&amp;ie=UTF-8" rel="nofollow noreferrer">silent refresh</a> for a SPA in React.</p>
  
  <p>In my controller method, I've got the following code:</p>
  
  <pre class="lang-rb prettyprint-override"><code>response.set_cookie(
    :foo,
    {
      value: 'testing',
      expires: 7.days.from_now,
      path: '/api/v1/auth',
      secure: true,
      httponly: true
    }
  )
  </code></pre>
  
  <p>I'm making a post request to this action with a <code>fetch</code> command like so:</p>
  
  <pre class="lang-js prettyprint-override"><code>fetch("http://localhost:3001/api/v1/auth", {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      email: 'aaron@example.com',
      password: '123456',
    })
  })
  </code></pre>
  
  <p>Not sure if that matters but I'm wondering if passing cookies in a XHR response doesn't work? However, this seems to be working as you can see in my response I'm getting this:</p>
  
  <pre><code>Set-Cookie: foo=testing; path=/api/v1/auth; expires=Sun, 26 Jan 2020 05:15:30 GMT; secure; HttpOnly
  </code></pre>
  
  <p>Also in the <code>Network</code> tab under <code>Cookies</code> I'm getting this:
  <a href="https://i.stack.imgur.com/ZJWPG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ZJWPG.png" alt="Network -&gt; Cookies tab"></a></p>
  
  <p>However, I'm NOT getting the cookie set under <code>Application -&gt; Cookies</code>:
  <a href="https://i.stack.imgur.com/AWNSP.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/AWNSP.png" alt="Cookies not showing up"></a></p>
  
  <p>To clarify, the React app is sitting on <code>localhost:3000</code> and the rails backend is listening on <code>localhost:3001</code>.</p>
  
  <p>Any ideas?</p>