title: Angular is not sending the Cookie received in Set-Cookie even if withCredentials is true
body: <p>For cookie based authentication, my server sends <code>Set-Cookie</code> to my Angular application. However, the application doesn't send the value back in further requests. Following is my code. </p>
  
  <pre><code>const httpOptions = {
    headers: new HttpHeaders({ 'Content-Type': 'application/json' }),
    withCredentials: true //this is required so that Angular returns the Cookies received from the server. The server sends cookies in Set-Cookie header. Without this, Angular will ignore the Set-Cookie header
  };
  
  public getUserProfile(){
      console.log('contacting server at '+this.API_URL +this.GET_USER_PROFILE_URL+"with httpOptions "+httpOptions);
      return this.http.get(this.GET_USER_PROFILE_URL,httpOptions )
        .map(response=&gt;{
          console.log('response from backend service',response);
          let result= &lt;ServerResponse&gt;response; 
          console.log("result is "+result.result+' with additional information '+result.additionalInformation)
          return result;
        })
        .catch(this.handleError);
    }
  </code></pre>
  
  <p>The server sends the cookie as follows in 200OK of my code (not shown here)</p>
  
  <p><code>Set-Cookie: id=...</code></p>
  
  <p>The next message however hasn't got the <code>id</code> in the cookie, thus the server returns 401. If I manually add the Cookie using browser's debug tools, then I get 200OK. Thus I am certain it is the absence of the <code>id</code> value in the cookie which is causing the issue.</p>
  
  <p>What am I doing wrong? Do I need to explicitly store the cookie received in <code>Set-Cookie</code> and explicitly add it in further requests? </p>
  
  <p>Update - 
  At the time when the SPA is initially loaded, the server sends <code>Set-Cookie</code> header with some other cookie's information related to <code>CSRF</code>. I notice that that cookie is still sent by the application. Could it be that Angular honors the first <code>Set-Cookie</code> header but ignores the subsequent ones?</p>
  
  <p>I have added couple of pics to explain what I mean</p>
  
  <p>During signing, the client sends a cookie related to CSRF. I dont think it is required as the client also sends CSRF Header but for some reason it does. The server responds with Set-Cookie with id in it</p>
  
  <p><a href="https://i.stack.imgur.com/xl1iz.png" rel="noreferrer"><img src="https://i.stack.imgur.com/xl1iz.png" alt="enter image description here"></a></p>
  
  <p>Then when I ask for profile, the client again sends the CSRF cookie but not the id cookie</p>
  
  <p><a href="https://i.stack.imgur.com/APXjH.png" rel="noreferrer"><img src="https://i.stack.imgur.com/APXjH.png" alt="enter image description here"></a></p>