Here we go again, another inquiry regarding httpOnly Cookies.
Seems like many others are facing the same predicament as me.
Even though I receive the cookie from the server, it doesn't accompany other requests.
I have mysite.example.com in angularjs attempting to communicate with api.example.com.
These are the response headers:
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://mysite.example.com
Connection: keep-alive
Content-Length: 2855
Content-Type: application/json
Date: Wed, 09 Jun 2021 00:52:54 GMT
Server: Apache/2.4.46 (Amazon) OpenSSL/1.0.2k-fips
Set-Cookie: WEB-TOKEN=158b691a-65fb-49c2-9d88-63bd1935531f;Version=1;Comment=;Max-Age=3600;Secure;HttpOnly;Expires=Wed, 09 Jun 2021 00:52:54 GMT
vary: Origin
Subsequently, in AngularJS, I make a request like this (from mysite.example.com):
$http.get('https://api.example.com/userdetails', { withCredentials: true, headers: { } });
Is there something amiss or omitted?
Appreciate any guidance!