#cookies

Web Development Bug Report

CloudFront signed cookies set, every request still 403: cookie domain, path and key groups

Tomás Herrera · Oct 10, 2026 · 8 min read

We moved private course videos behind CloudFront signed cookies. The app set the three cookies, yet the browser got 403 Missing Key-Pair-Id for every segment: cookies were scoped to the app's host, not the CDN's, and the behaviour trusted a different key group. How we debugged it with curl.

Web Development Bug Report

Logged in on app.example.com but the API on api.example.com saw no session: cookie Domain rules

Hannah Okafor · Aug 27, 2025 · 7 min read

After splitting our frontend and API onto separate subdomains, users logged in and were then treated as anonymous by every API call. The session cookie was host-only and fetch did not send credentials. How cookie scoping works across subdomains, the CORS settings that go with it, and the trade-offs.

Web Development

Cookie attributes in practice: SameSite, Secure, HttpOnly, __Host- and Partitioned

Daniel Tran · Jun 12, 2025 · 9 min read

A practical guide to cookie attributes for engineers who keep getting logged out of embedded widgets or failing security reviews: what SameSite, Secure, HttpOnly, __Host- and Partitioned really do, with tested defaults for common setups.