title: res.cookie not setting cookie in browser
body: <p>I am currently trying to set up a Node/Express app with a React client to interact with it. I setup passport to handle authentication with JWT. When the user logs in, I validate the email/password. I then set the cookie:</p>
  
  <pre><code>res.cookie('jwt', token, { httpOnly: true, secure: false });
  </code></pre>
  
  <p>I see the token being passed back in the response header, but when I inspect my Chrome browser's cookie under Developer Tools > Application > Cookies, I see an empty cookie. What am I doing wrong and how do I send the jwt in the response header with subsequent requests?</p>
  
  <p><strong>server/App.js</strong></p>
  
  <pre><code>const app = express()
  
  app.use(bodyParser.urlencoded({extended: true}));
  app.use(bodyParser.json());
  
  app.use(cookieParser());
  
  app.use(function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
  });
  
  app.post('/login', (req, res) =&gt; {
    passport.authenticate('local', { session: false }, (error, user) =&gt; {
      if (error || !user) {
        res.status(400).json({ error });
      }
  
      // Construct JWT payload
      const payload = {
        email: user.email,
        expires: Date.now() + parseInt(process.env.JWT_EXPIRATION_MS),
      };
  
      // Assign payload to req.user
      req.login(payload, {session: false}, (error) =&gt; {
        if (error) {
          res.status(400).send({ error });
        }
        // Generate a signed JWT
        const token = jwt.sign(JSON.stringify(payload), process.env.JWT_SECRET);
  
        // Assign JWT to cookie
        res.cookie('jwt', token, { httpOnly: true, secure: false });
        res.status(200).send({ email: user.email });
      });
    })(req, res);
  });
  </code></pre>
  
  <p><strong>client/LoginModal.js</strong></p>
  
  <pre><code>  handleLogin = async () =&gt; {
      const { name, email, password } = this.state
  
      try{
        const res = await axios.post('http://localhost:8080/login', {
          email: email,
          password: password,
        })
  
        if(res.status == 200){
          console.log("Logged in")
          console.log(res)
        }
  
      } catch (err) {
        console.log(err)
      }
    }
  </code></pre>
  
  <p>Edit: My current workaround is to send the token as part of the payload. My react client then grabs the token from the payload and stores it in the browser's cookie. Is there a way to avoid this workaround (see below for example)?</p>
  
  <p>server</p>
  
  <pre><code> res.status(200).send({ email: user.email, jwt: token });
  </code></pre>
  
  <p>client</p>
  
  <pre><code>  if(res.status == 200){
      cookies.set('jwt', res.data.jwt)
      cookies.set('email', res.data.email)
    }
  </code></pre>