title: Set-Cookie not sended on HTTP response header
body: <p>i´m creating a Authentication page with React and Express. I'm using JWT too.</p>
  <p>I´ve made this route in the back:</p>
  <p>server.js</p>
  <pre><code>...
  app.use(
    cookieSession({
      name: &quot;prode_session&quot;,
      secret: &quot;MIOURI_PRODE_SECRET&quot;, //add to .env variable
      httpOnly: false,
    })
  );
  app.use(cors());
  ...
  </code></pre>
  <p>auth.routes.js</p>
  <pre><code>app.post(&quot;/signin&quot;, controller.signin);
  user.routes.js
  
  app.get(
      &quot;/user&quot;,
      [authJwt.verifyToken],
      (req, res) =&gt; res.send(true)
    )
  </code></pre>
  <p>auth.controller.js</p>
  <pre><code>exports.signin = async (req, res) =&gt; {
    const user = await Users.findOne({
      where: { email: req.body.email },
    });
  
    try {
      if (!user) {
        return res.status(404).send({ message: &quot;User Not found.&quot; });
      }
  
      const passwordIsValid = bcrypt.compareSync(
        req.body.password,
        user.password
      );
  
      if (!passwordIsValid) {
        return res.status(401).send({
          message: &quot;Invalid Password!&quot;,
        });
      }
  
      const token = jwt.sign({ id: user.id }, config.secret, {
        expiresIn: 84000, //24hours
      });
  
      req.session.token = token;
      console.log(req.session);
  
      return res.status(200).send({
        isLogged: true,
        id: user.id,
        email: user.email,
        suscripcion: user.suscripcion,
        preference_id: user.preference_id,
        token,
      });
    } catch (error) {
      console.log(error);
    }
  };
  </code></pre>
  <p>authJWT.js</p>
  <pre><code>verifyToken = async (req, res, next) =&gt; {
    let token = req.session.token;
    console.log(`THIS IS THE TOKEN: ${token}`);
    if (!token) {
      return res.status(403).send({
        message: &quot;No token provided&quot;,
      });
    }
    jwt.verify(token, config.secret, (err, decoded) =&gt; {
      if (err) {
        console.log(err);
        return res.status(401).send({
          message: &quot;Unauthorized!&quot;,
        });
      }
      req.id = decoded.id;
  
      next();
    });
  };
  
  const authJwt = { verifyToken };
  
  module.exports = authJwt;
  </code></pre>
  <p>When I test this with POSTMAN, it works Ok, I mean, if first I try to make the GET request, the response is &quot;No token provided&quot;, but if I signin first, generate the token and then make the GET request, I get true.</p>
  <p>The problem is when I try to implement this in the front.</p>
  <p>I have this Login component in React in which I make a POST request with the credentials:</p>
  <pre><code>const handleSubmit = async (e) =&gt; {
      e.preventDefault();
      try {
        const response = await fetch(&quot;http://localhost:3000/signin&quot;, {
          method: &quot;POST&quot;,
          mode: &quot;cors&quot;,
          headers: {
            &quot;Content-Type&quot;: &quot;application/json&quot;,
            &quot;Access-Control-Allow-Origin&quot;: &quot;*&quot;,
          },
          body: JSON.stringify({
            email,
            password,
          }),
        });
        const data = await response.json();
        console.log(data);
  
        if (data.isLogged &amp;&amp; data.suscripcion === true &amp;&amp; data.token) {
          
                await tokenAvailable()
          //navigate(`/masthead/${email}&amp;${data.isLogged}&amp;${data.id}`);
        } else if (data.isLogged &amp;&amp; data.suscripcion === false) {
          navigate(&quot;/suscripcion&quot;, {
            state: { preference_id: data.preference_id },
          });
        } else {
          window.alert(&quot;Invalid Login&quot;);
        }
      } catch (error) {
        console.log(error);
      }
    };
  
  async function tokenAvailable() {
      const user = await fetch(&quot;http://localhost:3000/user&quot;, {
        method: &quot;GET&quot;,
        mode: &quot;cors&quot;,
        headers: {
          &quot;Content-Type&quot;: &quot;application/json&quot;,
          &quot;Access-Control-Allow-Origin&quot;: &quot;*&quot;,
        },
      });
  
      const response = await user.json();
      setUser(await response);
      console.log(await response);
      return response;
    }
  </code></pre>
  <p>When I make the POST, the GET request is executed (tokenAvailable function) after receiving the response, but I receive &quot;No token Provided&quot; while I expect to receive &quot;true&quot; as in Postman.</p>
  <p>From what I debug, the authJWT.js file, is not receiving nothing from the req.session.token.
  When I compare the headers from postman and the browser, in postan the SET-cookie key appears, but in the browser not.</p>
  <p>postman:</p>
  <p><a href="https://i.stack.imgur.com/e5yur.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/e5yur.png" alt="enter image description here" /></a></p>
  <p>browser:</p>
  <p><a href="https://i.stack.imgur.com/rNXeR.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/rNXeR.png" alt="enter image description here" /></a></p>
  <p>I need some help here. I´ve been strugling with this for almost 3 days.</p>