Cross-domain cookie is lost at refresh

Question

My API (Actix-web Rust) is hosted on render.com and my frontend (Vue 3 app) on vercel.com. When I log in, my API send a cookie with SameSite=None, Secure=true and domain render.com. But when I refresh or leave the page, the cookie is lost.

Is it a normal behavior? How avoid loosing my cross domain cookie on page reload?

Answer 1

I think you need to make sure the domain you set for the cookie is correct.

Sites deployed on Render get an .onrender.com subdomain by default (not .render.com, and you can add a custom domain if you want. Make sure you're setting the cookie domain to your backend API domain.