Fix a login cookie that disappears between frontend and backend

Login succeeds, but the next request is anonymous. The token may have been set on the wrong host, rejected by cookie rules or omitted from the follow-up request.

Why this happens

Cookie domain, path, SameSite and Secure attributes control where a browser stores and sends a cookie. Cross-origin requests also need the appropriate credential and CORS configuration.

Step-by-step solution

1. Inspect Set-Cookie in the login response and the browser’s cookie diagnostics. Confirm the cookie was accepted before investigating session lookup.

2. Check the next request’s host, scheme and credentials setting. For a proxy deployment, verify that cookie scope matches the browser-facing origin.

3. Use production HTTPS and appropriate cookie attributes. Keep session cookies HttpOnly where possible and address CSRF protection separately.

Worked example

A cookie scoped to an API hostname will not automatically become a cookie for an unrelated frontend hostname. A same-origin proxy can simplify the browser-facing arrangement, but its forwarding behaviour still needs testing.

Verify the fix

After login, a session-check request should identify the user. Logout should invalidate the session, and an expired cookie should not retain access.

Prevent a repeat

Test local and production origins independently. Do not fix the problem by moving a sensitive session token into an exposed URL.

Reference

Official documentation or standards guidance

An original Gistmax troubleshooting guide. Scenarios and sample values are illustrative; configuration depends on your software version and environment. Cover diagram: Gistmax Tutorials.