title: Is it possible to set an HttpOnly Cookie from one domain to another subdomain
body: <p>I originally posted this question here: <a href="https://security.stackexchange.com/questions/255737/is-it-possible-to-set-an-httponly-cookie-from-one-domain-to-another-subdomain">https://security.stackexchange.com/questions/255737/is-it-possible-to-set-an-httponly-cookie-from-one-domain-to-another-subdomain</a></p>
  <p>Please keep in mind that this question is specific to cookies with the <code>HttpOnly</code> flag set to <code>true</code>.</p>
  <p>I am pretty sure that the answer to my question is no, but I have been have a hard time finding an answer through official documentation or other posts here. Here is simple use case for some context:</p>
  <ol>
  <li>Python backend web application (api.domain.com)</li>
  <li>Frontend JavaScript SPA (app.domain.com)</li>
  <li>post requests to <code>api.domain.com/api/auth/login/</code> made from <code>app.domain.com</code> using axios with the correct <code>username</code> and <code>password</code> return a response with an <code>access</code> JWT token in the body and the response sets a <code>refresh</code> cookie with an HttpOnly flag [should fail, since I believe that the cookie cannot be set on <code>app.domain.com</code> from an API request to <code>api.domain.com</code>? -- this is my question]</li>
  <li>the <code>access</code> token is stored in memory and passed with each API request</li>
  <li>requests made to <code>api.domain.com/api/auth/refresh/</code> are sent on a schedule to refresh the short-lived <code>access</code> token.</li>
  </ol>
  <p>I typically host the frontend app and backend app on the same subdomain (<code>app.domain.com</code>) and do path-based routing with something like CloudFront or nginx, and this works well. For example, all requests starting with <code>/api/*</code> are sent to the backend, and all other requests are sent to the frontend app. Trying to use a separate subdomain for the API seems to fail no matter what options I use for setting the cookie on the server.</p>
  <p>Can someone help me confirm that it is in fact not possible to set an HttpOnly cookie on a subdomain like <code>app.domain.com</code> from an API request hosted on <code>api.domain.com</code>? It would be great if anyone can also help me find where this could possibly be found in official documentation.</p>
  <p>Searching for <code>set httpOnly cookie across subdomains</code>, I haven't found anything directly relevant. I also didn't find anything in these resources that directly answers my question:</p>
  <p><a href="https://owasp.org/www-community/HttpOnly" rel="nofollow noreferrer">https://owasp.org/www-community/HttpOnly</a></p>
  <p><a href="https://docs.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDN" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDN</a></p>