title: Set cookies for cross origin requests
body: <p>How to share cookies cross origin? More specifically, how to use the <code>Set-Cookie</code> header in combination with the header <code>Access-Control-Allow-Origin</code>?</p>
  
  <p>Here's an explanation of my situation:</p>
  
  <p>I am attempting to set a cookie for an API that is running on <code>localhost:4000</code> in a web app that is hosted on <code>localhost:3000</code>. </p>
  
  <p>It seems I'm receiving the right response headers in the browser, but unfortunately they have no effect. These are the response headers:</p>
  
  <pre>
  HTTP/1.1 200 OK
  Access-Control-Allow-Origin: http://localhost:3000
  Vary: Origin, Accept-Encoding
  Set-Cookie: token=0d522ba17e130d6d19eb9c25b7ac58387b798639f81ffe75bd449afbc3cc715d6b038e426adeac3316f0511dc7fae3f7; Max-Age=86400; Domain=localhost:4000; Path=/; Expires=Tue, 19 Sep 2017 21:11:36 GMT; HttpOnly
  Content-Type: application/json; charset=utf-8
  Content-Length: 180
  ETag: W/"b4-VNrmF4xNeHGeLrGehNZTQNwAaUQ"
  Date: Mon, 18 Sep 2017 21:11:36 GMT
  Connection: keep-alive
  </pre>
  
  <p>Furthermore, I can see the cookie under <code>Response Cookies</code> when I inspect the traffic using the Network tab of Chrome's developer tools. Yet, I can't see a cookie being set in in the Application tab under <code>Storage/Cookies</code>. I don't see any CORS errors, so I assume I'm missing something else.</p>
  
  <p>Any suggestions?</p>
  
  <h3>Update I:</h3>
  
  <p>I'm using the <a href="https://www.npmjs.com/package/request" rel="noreferrer">request</a> module in a React-Redux app to issue a request to a <code>/signin</code> endpoint on the server. For the server I use express.</p>
  
  <p>Express server:</p>
  
  <pre>
  res.cookie('token', 'xxx-xxx-xxx', { maxAge: 86400000, httpOnly: true, domain: 'localhost:3000' })
  </pre>
  
  <p>Request in browser:</p>
  
  <pre>
  request.post({ uri: '/signin', json: { userName: 'userOne', password: '123456'}}, (err, response, body) => {
      // doing stuff
  })</pre>
  
  <h3>Update II:</h3>
  
  <p>I am setting request and response headers now like crazy now, making sure that they are present in both the request and the response. Below is a screenshot. Notice the headers <code>Access-Control-Allow-Credentials</code>, <code>Access-Control-Allow-Headers</code>, <code>Access-Control-Allow-Methods</code> and <code>Access-Control-Allow-Origin</code>. Looking at the issue I found at <a href="https://github.com/mzabriskie/axios/issues/191#issuecomment-311069164" rel="noreferrer">Axios's github</a>, I'm under the impression that all required headers are now set. Yet, there's still no luck...</p>
  
  <p><a href="https://i.stack.imgur.com/d6Qv6.png" rel="noreferrer"><img src="https://i.stack.imgur.com/d6Qv6.png" alt="enter image description here"></a></p>