#samesite

Web Development Bug Report

Logged in on app.example.com but the API on api.example.com saw no session: cookie Domain rules

Hannah Okafor · Aug 27, 2025 · 7 min read

After splitting our frontend and API onto separate subdomains, users logged in and were then treated as anonymous by every API call. The session cookie was host-only and fetch did not send credentials. How cookie scoping works across subdomains, the CORS settings that go with it, and the trade-offs.

Web Development

Cookie attributes in practice: SameSite, Secure, HttpOnly, __Host- and Partitioned

Daniel Tran · Jun 12, 2025 · 9 min read

A practical guide to cookie attributes for engineers who keep getting logged out of embedded widgets or failing security reviews: what SameSite, Secure, HttpOnly, __Host- and Partitioned really do, with tested defaults for common setups.