Why isn't my cookie being sent on cross-origin API requests?

The most likely cause is the SameSite attribute. Browsers default to SameSite=Lax, which blocks cookies on cross-origin fetch/XHR requests. To fix this: set SameSite=None and Secure on the cookie, use credentials: 'include' in your fetch call, and ensure the server responds with Access-Control-Allow-Credentials: true and a specific Access-Control-Allow-Origin (not wildcard *). All four conditions must be met.

What is the difference between HttpOnly and Secure cookie flags?

Secure ensures the cookie is only sent over HTTPS connections, preventing interception on unencrypted HTTP. HttpOnly prevents JavaScript (document.cookie) from reading or modifying the cookie, protecting against XSS attacks. Both should always be set on authentication cookies. HttpOnly doesn't prevent the cookie from being sent — it only prevents client-side script access.

How do I inspect cookies in Chrome DevTools?

Open DevTools (F12) > Application tab > expand Cookies in the left sidebar > click your domain. This shows all cookies with their Name, Value, Domain, Path, Expires, HttpOnly, Secure, and SameSite attributes. Also check the Network tab: click a request and look at Set-Cookie in response headers (Chrome shows warning icons on blocked cookies) and Cookie in request headers to verify what's actually being sent.

Should I use cookies or Authorization headers for API authentication?

Use HttpOnly cookies for browser-based apps — they're automatically sent with requests and protected from XSS. Use Authorization: Bearer headers for non-browser clients (mobile apps, server-to-server) and cross-origin APIs where cookie management is complex. If your API serves both browsers and other clients, support both: cookies for the web app and Bearer tokens for everything else. Never store tokens in localStorage (vulnerable to XSS).

How do I handle authentication when third-party cookies are blocked?

If your auth service is on a different domain than your app, third-party cookie restrictions will break cookie-based auth. Alternatives: use the same parent domain (auth.example.com + app.example.com with Domain=.example.com), switch to token-based auth with Authorization headers, implement OAuth 2.0 authorization code flow with PKCE, or use the Storage Access API for limited third-party cookie access with user consent.

Debugging Cookies and Authentication Headers