How to transfer cookies from a subdomain to php?

Question

HTTP Cookies

There is a web application on the example.com
domain There is a PHP REST API on the api.example.com

domain When POSTing a request from example.com to api.example.com/signin
api.example.com/signin returns a set-cookie token, but for some reason then it does not save it in the browser and, accordingly, does not send it with


subsequent requests .

if (isset($_COOKIE['token'])) {
 .....
} else {
......
setcookie("token", $new_token, $expr_time,' /', '.example.com', false, false);
}

What can be done on the back? Maybe some headers are missing?

Answer 1

Solved the problem by adding withCredentials: true to the headers of each request on the side of the web application.
with axios looks like this

axios.post(API_SERVER + '/login', { email, password }, { withCredentials: true })

and

axios.get(API_SERVER + '/todos', { withCredentials: true })

Answer 2

Cookies need SameSite=none and Secure attributes (it doesn't work without https)
https://developer.mozilla.org/en-US/docs/Web/HTTP/...
UPD: If possible, it's better not to store the token in a cookie in favor of a JWT, for example.