title: Issues setting session cookies in other subdomain
body: <p>I've been tumbling around for a while on the HTTP set-cookie topic but I'm not making any progress. My situation goes as follows:</p>
  <p>My API is hosted on api.mysite.com and I have an admin dashboard on admin.mysite.com. I make a POST request from admin.mysite.com to api.mysite.com/login to verify credentials and it returns the session cookie. The cookie configuration is:</p>
  <pre class="lang-php prettyprint-override"><code>
  session_set_cookie_params([
      'lifetime' =&gt; 36000,
      'path' =&gt; '/',
      'domain' =&gt; '.mysite.com.co',
      'secure' =&gt; 1,
      'httponly' =&gt; 0,
      'samesite' =&gt; 'None'
  ]);
  
  </code></pre>
  <p>The response seems okay:</p>
  <pre><code>HTTP/1.1 200 OK
  Date: Thu, 04 Nov 2021 16:22:57 GMT
  Server: Apache/2.4.41 (Ubuntu)
  Strict-Transport-Security: max-age=63072000
  Access-Control-Allow-Origin: https://admin.mysite.com
  Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, accept, authorization, client-security-token, Cache-Control, X-Mashape-Authorization
  Access-Control-Allow-Methods: POST, GET, OPTIONS
  Access-Control-Expose-Headers: Content-Security-Policy, Location
  Access-Control-Max-Age: 1000
  Upgrade: h2
  Connection: Upgrade, Keep-Alive
  Set-Cookie: PHPSESSID=hash; expires=Fri, 05-Nov-2021 02:22:57 GMT; Max-Age=36000; path=/; domain=.mysite.com; secure; SameSite=None
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate
  Pragma: no-cache
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Access-Control-Allow-Credentials: true
  Content-Length: 549
  Keep-Alive: timeout=5, max=100
  Content-Type: text/html; charset=UTF-8
  </code></pre>
  <p>But the cookie is not stored. However, it is stored if I make the request from api.mysite.com/testCookies to api.mysite.com/login so it seems to be a domain/site problem (maybe CORS?)</p>
  <p>I will appreciate any guidance on this topic.</p>