The latest articles on DEV Community by Harsh Oza (@ozaharsh95). https://dev.to/ozaharsh95 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F1129288%2F4695c454-dd4b-4523-b34c-bcace92923cc.png https://dev.to/ozaharsh95 en Harsh Oza Fri, 07 Aug 2026 11:43:35 +0000 https://dev.to/ozaharsh95/bug-cross-site-cookie-restrictions-1hd3 https://dev.to/ozaharsh95/bug-cross-site-cookie-restrictions-1hd3 <h2> What went wrong? </h2> <p>When a user logged in on my deployed frontend (<code>https://domainA.app</code>), the credentials succeeded, but they were immediately treated as unauthenticated. Protected endpoints (like <code>/stats/admin/*</code>) failed with a <code>401 Unauthorized</code> status code.</p> <p>Crucially, this behavior <strong>did not</strong> happen on localhost. </p> <h2> Why did it happen? </h2> <p>This is caused by cross-site cookie restrictions enforced by modern web browsers.</p> <ul> <li> <strong>On localhost:</strong> The frontend (<code>http://localhost:5173</code>) and backend (<code>http://localhost:8000</code>) share the same hostname (<code>localhost</code>). Browsers treat different ports on localhost as a secure, shared origin context, meaning cookie exchange works by default without strict rules.</li> <li> <strong>On production:</strong> The frontend (<code>domainA.app</code>) and backend (<code>domainB.app</code>) are hosted on completely different domains (cross-site).</li> </ul> <p><strong>The Cookie Block:</strong> <br> When the backend tries to set the authentication session cookie (<code>better-auth.session_token</code>), the browser blocks and rejects it because the cookie does not have the necessary flags to be sent across different domains:</p> <ul> <li> <code>SameSite=None</code>: Tells the browser that this cookie is allowed to be sent on cross-site requests.</li> <li> <code>Secure</code>: Enforces that the cross-site cookie is only sent over HTTPS (which is required if <code>SameSite=None</code> is set).</li> </ul> <p><strong>The Result:</strong> <br> Because the browser rejected the cookie, it was never stored. When the frontend made requests to <code>/stats/admin/*</code>, no session cookie was included. The backend session middleware received no credentials and returned a <code>401 Unauthorized</code> error.</p> fullstack browser webdev programming