title: Django/React - Cookies Stored Under Wrong Domain Name
body: <p>I'm using CSRF and Session cookies in a Django React project. Everything works great on local development.</p>
  <p>I am having an issue with cookies in the production environment.</p>
  <p>The backend and frontend are hosted on Heroku under different domains.</p>
  <p>When I request a CSRF token from the backend, the token is stored under the domain name from where the backend is hosted. This means my frontend is unable to access the cookies.</p>
  <p>If I call the backend APIs directly from the browser, the cookies work fine since they're stored under the same domain name I sent the request to.</p>
  <p>I've been struggling to solve the issue, and any help would be appreciated.</p>
  <pre><code># settings.py 
  
  
  SESSION_COOKIE_HTTPONLY = True
  
  CSRF_COOKIE_SAMESITE = &quot;Lax&quot;
  SESSION_COOKIE_SAMESITE = &quot;Lax&quot;
  
  if config(&quot;ENVIRONMENT&quot;) == &quot;PRODUCTION&quot;:
      CORS_ORIGIN_WHITELIST = [&quot;https://biz.mysite.tech&quot;]
  else:
      CORS_ORIGIN_WHITELIST = [&quot;http://localhost:3000&quot;]
  
  CORS_EXPOSE_HEADERS = [&quot;Content-Type&quot;, &quot;X-CSRFToken&quot;]
  CORS_ALLOW_CREDENTIALS = True
  </code></pre>
  <pre><code>// Axios settings in React 
  
  {
    withCredentials: true,
    credentials: &quot;include&quot;,
    headers: {
      Accept: &quot;application/json&quot;,
      &quot;Content-Type&quot;: &quot;application/json&quot;,
      &quot;X-CSRFToken&quot;: cookies.get(&quot;csrftoken&quot;),
    },
  }
  
  </code></pre>