title: Session cookies working successfully in Postman, not Chrome
body: <p>This is my first time messing around with session cookies and I'm having a pretty hard time. I'd really appreciate any help!</p>
  <p>I'd like to note:</p>
  <ul>
  <li>I'm experiencing all of these issues locally on Chrome</li>
  <li>I have absolutely no issue receiving the cookie and authenticating the request using Postman. It's Chrome that doesn't set the cookie.</li>
  </ul>
  <h2>The Server</h2>
  <p>My server is running on http://localhost:7000/</p>
  <p>I'm sending cookies to the client from the server by setting the <code>Set-Cookie</code> header like so:</p>
  <pre><code>val cookie = &quot;&quot;&quot;jwt=$token; Path=/; Domain=localhost; Max-Age=86400; Expires=Thu, 19 Aug 2021 12:20:23 GMT; SameSite=Strict;&quot;&quot;&quot;
  
  ctx.header(&quot;Set-Cookie&quot;, cookie)
  </code></pre>
  <p>I also have cors set up:</p>
  <pre><code>it.header(Header.ACCESS_CONTROL_ALLOW_CREDENTIALS, &quot;true&quot;)
  it.header(Header.ACCESS_CONTROL_ALLOW_METHODS, &quot;*&quot;)
  it.header(Header.ACCESS_CONTROL_ALLOW_HEADERS, &quot;*&quot;)
  </code></pre>
  <h2>The Front End</h2>
  <p>My F.E is running on http://localhost:3000/</p>
  <p>Here's what an auth request/response looks like:
  <a href="https://i.stack.imgur.com/BGzgl.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BGzgl.png" alt="enter image description here" /></a></p>
  <p>Here's what one of the failed requests looks like. Notice how there is no cookie set:
  <a href="https://i.stack.imgur.com/TSAuN.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/TSAuN.png" alt="enter image description here" /></a></p>
  <p>I've also noticed that the cookie does not show up in Chrome's <code>Cookies in use</code> view:
  <a href="https://i.stack.imgur.com/h09mk.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/h09mk.png" alt="enter image description here" /></a></p>
  <h2>My Understanding</h2>
  <p>From what I understand, I can use <code>SameSite=Strict</code> since both FE &amp; BE are running locally on localhost.</p>
  <p>When I move into production, FE &amp; BE will not be on the same domain. Then, I'd have to use <code>SameSite=None; Strict</code>. Is this correct?</p>
  <p>Also, I'm aware that I can also include <code>HttpOnly</code>, but I'm not at the moment for debugging purposes.</p>
  <p>Is my understanding correct?</p>
  <h2>Thanks!</h2>
  <p>Thanks in advance for any help you might be able to provide, it's greatly appreciated!</p>