title: Unable to set httpOnly cookie between Heroku and Netlify + cloudflare
body: <p>I have the following problem. I am trying to set httpOnly cookie and nothing happens. I spent a few hours trying to solve this issue and I have no idea what is going on... My architecture is the following:</p>
  <p><strong>Backend</strong>: Python fast-api hosted on Heroku, available at <a href="https://api.mysuperdomain.com" rel="nofollow noreferrer">https://api.mysuperdomain.com</a>.</p>
  <p><strong>Frontend</strong>: GatsbyJs hosted on Netlify, available at <a href="https://mysuperdomain.com" rel="nofollow noreferrer">https://mysuperdomain.com</a></p>
  <p>When I call login request from React component:</p>
  <pre><code>  const handleSubmit = async (e) =&gt; {
      e.preventDefault()
      const config = {
        headers: {
          crossDomain: true,
          withCredentials: true,
          'Content-Type': 'application/x-www-form-urlencoded'
        }
      }
      const requestBody = {
        username: emailRef.current.value,
        password: passwordRef.current.value
      }
  
      try {
        const data = await axios.post('https://api.mysuperdomain.com/login', qs.stringify(requestBody), config)
  </code></pre>
  <p>I get response from my backend with headers, set-cookie:</p>
  <pre><code>set-cookie: Authorization=&quot;Bearer somethinghere&quot;; Domain=.mysuperdomain.com; expires=Tue, 28 Jul 2020 20:40:32 GMT; Max-Age=1800; Path=/; SameSite=lax
  </code></pre>
  <p>unfortunately in browser storage I cannot see this cookie.</p>
  <p>My backend(API) sets the cookie in the following way:</p>
  <pre><code>@app.post(&quot;/login&quot;)
  async def login(form_data: OAuth2PasswordRequestForm = Depends()):
      user = authenticate_user(fake_users_db, form_data.username, form_data.password)
      if not user:
          raise HTTPException(status_code=400, detail=&quot;Incorrect username or password&quot;)
  
      access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
      access_token = create_access_token(
          data={&quot;sub&quot;: form_data.username}, expires_delta=access_token_expires
      )
  
      token = jsonable_encoder(access_token)
  
      response = JSONResponse({'status': 'authenticated'})
      response.set_cookie(
          key=&quot;Authorization&quot;,
          value=f&quot;Bearer {token}&quot;,
          domain=&quot;.mysuperdomain.com&quot;,
          httponly=True,
          max_age=1800,
          expires=1800,
      )
      return response
  </code></pre>
  <p>My DNS records are within the Cloudflare, and CNAME record for backend is proxied:</p>
  <pre><code>Typ    Name  Content                                        TTL    Proxy status 
  CNAME  api   limitless-starfish-something.herokudns.com     Auto   Proxied
  </code></pre>
  <p>SSL/TLS encryption mode is Flexible (Encrypts traffic between the browser and Cloudflare). Backend at Heroku has no SSL Certificate therefore I set flexible SSL/TLS encryption mode.</p>
  <p>Maybe it is somehow related to above config?</p>