Tag See all →

#cors

2 stories

Banner: logged in on app subdomain but the API subdomain saw no session, cookie Domain rules

Web Development Bug Report

Logged in on app.example.com but the API on api.example.com saw no session: cookie Domain rules

Hannah Okafor · Aug 27, 2025 · 7 min read

After splitting our frontend and API onto separate subdomains, users logged in and were then treated as anonymous by every API call. The session cookie was host-only and fetch did not send credentials. How cookie scoping works across subdomains, the CORS settings that go with it, and the trade-offs.

Banner: CORS preflight request rejected by nginx after adding an Authorization header

Web Development Bug Report

CORS preflight fails after adding an Authorization header behind nginx

Daniel Tran · Feb 11, 2025 · 9 min read

Moving our SPA from cookie auth to bearer tokens broke every API call with a CORS error. The Authorization header triggered an OPTIONS preflight, our nginx auth check rejected it, and error responses carried no CORS headers.