I know that cross-origin is tricky for security-reasons and that setting a cookie for another host/domain is generally not allowed, but I think what I want should be allowed: I have two hosts for my service: ui.my.com and rest.my.com, where I serve my Angular-based web-app on https://ui.my.com and RESTful service-requests are done via https://rest.my.com. All cross-origin-stuff works fine, but no cookie is ever set for rest.my.com. My RESTful service on https://rest.my.com sends the response-header Set-Cookie: AUTH_COOKIE=hmt79np5yyf1jr649mhrczvkz; Max-Age=3600; Expires=Tue, 26-Aug-2025 04:54:26 GMT I see this response-header in my browser's "Network"-tab. Since this response-header is coming from https://rest.my.com/blabla, I'd expect this cookie to be stored for https://rest.my.com and when performing another GET-request in another browser-tab/-window I'd expect this cookie to be available and sent to the server, when accessing https://rest.my.com/whatever later. Important: I do not expect my Angular-web-app on https://ui.my.com to ever be able to read this cookie. It would be perfectly fine, if the browser hid this cookie from Angular. However, since the Set-Cookie comes from https://rest.my.com, I'd expect this cookie to be available for communication with https://rest.my.com after the browser received the Set-Cookie-header from there. Btw. my https://rest.my.com sends the following CORS-related response-headers: Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization Access-Control-Expose-Headers: Set-Cookie However, this doesn't work. Though the cookie reaches my browser (I can see it in the "Network"-tab), the cookie is completely ignored and not stored in my browser. Why? And what do I need to do to get the cookie into my browser's cookie-storage. Best regards, Marco Continue reading...
