Allow cookie on unsecure domain

Question

I have my project running on https://localhost:5001 and I want to access it from a site running on http://localhost:3000.

The site on http://localhost:3000 can make a successful authenticate request but the auth cookie does not get set in JsonServiceClient.

Running on https the cookie gets set correctly.

These are the headers:

General
Request URL: https://localhost:5001/json/reply/Authenticate
Request Method: POST
Status Code: 200 
Remote Address: [::1]:5001
Referrer Policy: strict-origin-when-cross-origin

Response
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Allow, Authorization, X-Args
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD
access-control-allow-origin: http://localhost:3000
content-type: application/json; charset=utf-8
date: Wed, 10 Nov 2021 04:03:44 GMT
server: Kestrel
set-cookie: ss-id=yjHzB7bEOgfKvSOy1hEL; path=/; secure; samesite=lax; httponly
set-cookie: ss-pid=8bGyiksCKX2TFcpvHOnE; expires=Sun, 10 Nov 2041 04:03:44 GMT; path=/; secure; samesite=lax; httponly
set-cookie: ss-opt=temp; expires=Sun, 10 Nov 2041 04:03:44 GMT; path=/; secure; samesite=lax; httponly
set-cookie: X-UAId=1; expires=Sun, 10 Nov 2041 04:03:44 GMT; path=/; secure; samesite=lax; httponly
vary: Accept
x-powered-by: ServiceStack/5.120 NetCore/Windows

request
:authority: localhost:5001
:method: POST
:path: /json/reply/Authenticate
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: en,en-GB;q=0.9
cache-control: no-cache
content-length: 52
content-type: application/json
origin: http://localhost:3000
pragma: no-cache
referer: http://localhost:3000/
sec-ch-ua: "Google Chrome";v="95", "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36

I am trying to find the right setting to allow the cookie on non-secure domain. Sessions have been added to the project by the Auth plugin.

I tried:

SetConfig(new HostConfig
{
    AddRedirectParamsToQueryString = true,
    DebugMode = AppSettings.Get(nameof(HostConfig.DebugMode), HostingEnvironment.IsDevelopment()),
    UseHttpOnlyCookies = false,
    UseSecureCookies = false,
});

But it is still not saving the cookie for subsequent requests.

What do I need to set to allow the cookie on http?

edit:

Cors:

appHost.Plugins.Add(new CorsFeature(
                allowOriginWhitelist: new[]
                { 
                    "https://localhost:5001",
                    "http://localhost:3000",
                    "https://localhost:3000"
                },
                allowCredentials: true,
                allowedHeaders: "Content-Type, Allow, Authorization, X-Args"));
        }

I am creating typescript client like so:

    let client = new JsonServiceClient(environment.apiUrl);
    let req = new Authenticate();
    req.userName = email;
    req.password = password;
    req.rememberMe =rememberMe;

    let resp = await client.post(req);

Failed subsequent request:

equest URL: https://localhost:5001/json/reply/NextInputRequest
Request Method: GET
Status Code: 401 
Remote Address: [::1]:5001
Referrer Policy: strict-origin-when-cross-origin
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Allow, Authorization, X-Args
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD
access-control-allow-origin: http://localhost:3000
content-length: 0
date: Wed, 10 Nov 2021 06:23:58 GMT
server: Kestrel
set-cookie: ss-pid=bS8yNkiGoDuJpkTicMry; expires=Sun, 10 Nov 2041 06:23:59 GMT; path=/; secure; samesite=lax; httponly
set-cookie: ss-id=1c38cciEgpnwTEg5DDaf; path=/; secure; samesite=lax; httponly
vary: Accept
www-authenticate: credentials realm="/auth/credentials"
x-powered-by: ServiceStack/5.120 NetCore/Windows
:authority: localhost:5001
:method: GET
:path: /json/reply/NextInputRequest
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: en
cache-control: no-cache
content-type: application/json
origin: http://localhost:3000
pragma: no-cache
referer: http://localhost:3000/
sec-ch-ua: "Google Chrome";v="95", "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36

Answer 1

If this CORS Request is not from using @servicestack/client JsonServiceClient which is configured to send cookies by default, it needs to be configured to include the credentials, e.g:

fetch('https://example.com', {
  credentials: 'include'
});

If you think everything is configured correctly check that it's not the result of Chrome localhost Cookies bug.

Otherwise there's a lot of relevant information required to help identify the issue that's missing:

• Configuration of the Cors Feature.
• Show the client code used to make the CORS Request
• The failed HTTP Request/Response headers that failed to include cookies
• A screenshot of the Errors in your browsers dev console, e.g. Web Inspector