Cookies are not set when port differs on the same domain

[m4nuC]

A request from localhost:3000 to localhost:8000 will ignore cookies. Though cookies are supposed to be port agnostics. Is this an implementation issue ?

[dgraham]

Cookies are not included in the fetch request by default: https://github.com/github/fetch#sending-cookies.

[m4nuC]

Thanks. It turned out to be a cross domain issue cause by the 'credentials' : 'include' config.

[m4nuC]

Tho that still doesn't explain why different ports are being treated as cors. I shouldn't have to add 'credentials' : 'include' for cookies to work

[dgraham]

Port number is a component of the same-origin policy.

[m4nuC]

Yea. Got it, thanks

[BrendanFDMoore]

Sorry to raise this from the dead, but I don't believe that interpretation is correct @dgraham

See this RFC: https://tools.ietf.org/html/rfc6265
and the summary via quoted relevant sections lifted from here: https://stackoverflow.com/questions/1612177/are-http-cookies-port-specific

For historical reasons, cookies contain a number of security and privacy infelicities. For example, a server can indicate that a given cookie is intended for "secure" connections, but the Secure attribute does not provide integrity in the presence of an active network attacker. Similarly, cookies for a given host are shared across all the ports on that host, even though the usual "same-origin
policy" used by web browsers isolates content retrieved via different ports.

8.5. Weak Confidentiality
Cookies do not provide isolation by port. If a cookie is readable by a service running on one port, the cookie is also readable by a service running on another port of the same server. If a cookie is writable by a service on one port, the cookie is also writable by a service running on another port of the same server.

From this, I would expect cookies set for example.com:3000 to be sent to example.com:4000 also.

[mislav]

@BrendanFDMoore Your interpretation of the spec might be absolutely correct. However, our fetch polyfill does not implement anything regarding cookies, and never will. Handling of cookies is either up to the browser's native implementation of fetch (if there is one), or native implementation of XMLHttpRequest (which our polyfill uses). We can't affect anything about how the browser stores or sends cookies.