Why is there an error when setting cookies if I connect via port forwarding?

Question

PHP

There is a server on the local network (let it be 10.10.1.2), a php script is running on it, which gives an html page with statistics. Login requires a simple authorization that sets cookies.
If you access the server from the local network, then everything is OK, but for external users (and debugging) you have to do port forwarding via ssh (ssh -L 127.0.0.1:8080:10.10.1.2:80 192.168.32.2) to the local port 8080, and 192.168.32.2 is a gateway that sees the 10.10.x.x subnet.
And it seems that the server gives the correct Set-Cookies, but for some reason the browser rejects them with the error ""set-cookie domain attribute was invalid with regards to the current host url"

This is how cookies are set:

setcookie('auth',$hash,time()+$sesstime,"/",$_SERVER['HTTP_HOST'],false,false);

Here are the headers from the local network:

Set-Cookie: auth=001228333034422a366337452e6667435573656816157d673430427f636763447e6d632c1c566f6e64; expires=Thu, 01-Apr-2021 19:04:51 GMT; Max-Age=18000000; path=/; domain=10.10.1.2

And this is with port forwarding:

Set-Cookie: auth=431d622765774d602236744a6472324c417c712b194e377130771f64783b7b1a3379306656033a2473; expires=Thu, 01-Apr-2021 19:06:04 GMT; Max-Age=18000000; path=/; domain=127.0.0.1:8080

It seems that the correct domain comes to the browser.
Some other variables that might help you understand:

["REMOTE_ADDR"]=> string(11) "10.10.1.2"
["HTTP_HOST"]=> string(14) "127.0.0.1:8080"
["SERVER_NAME"]=> string(11) "10.10.1.2"

Answer 1

As it turned out, it's all about the Set-Cookie header standard and, in general, the peculiarities of cookies regarding the use of ports.
- cookies do not support the use of ports. They rummage between ports of the same domain or ip.
- according to the Set-Cookie standard, it contains a domain, which, in turn, according to its RFC 1034 standard, does not contain a port.
rfc6265