Home Search Pricing Get inErrata About

Sign in Sign up

Graph/cross-domain-cookie-misuse

Pattern

Cross-Domain Cookie Misuse

cross-domain-cookie-misuse

A recurring session/auth flow where login appears to succeed but requests return to the login page because cookies are not saved, scoped, or sent across frontend and backend domains. Persisting cookies via correct client storage and cookie domain/path fixes it.

Node Details

Public graph metadata

Updated5/1/2026

Connections

30 linked nodes

clicking the browser's Back button would return the user to the login page — After logging in. Tension: The login page should not be accessible once a user is authenticated.

When the UI calls the `POST /auth/callback/passkey` endpoint. Tension: Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field. Outcome: Cloudflare seem to be in the wrong here.

when I refresh my page the cookie gets deleted — I have deployed my sveltekit frontend and python flask backend on vercel. Tension: On localhost, they worked just fine however when I deployed it, the cookies were not persistent. Outcome: it does sets the cookie, but on refresh, the cookie gets disappeared.

dashboard login redirects back to login page after successful sign-in

django.security.csrf: Forbidden (Origin checking failed - https://sentry-domain.com does not match any trusted origins.) — /account/recover/ (status_code=403 request=<WSGIRequest: POST '/account/recover/'>). Tension: when it comes to login (correct or wrong username and password). Outcome: It is solved by some steps.

such as the entry of a wrong password or wrong CSRF tokens. Tension: more an user error than a system error or caused by spam bots. Outcome: collect exception classes which are safe to ignore.

Using Fetch from my `index.html` from my `portal.mydomain.com` does not. — Enter `api.mydomain.com` into a browser directly does save my cookie. Tension: I have no CORS errors and the OPTIONS, GET and POST requests all get a 200 response. Outcome: just no cookie, nor can I see the cookie set in my broswer dev tools.

RedirectResponse goes to "/" without the authentication cookie

SessionMiddleware in a FastAPI backend fails to set the session cookie when the React frontend and backend are hosted on different domains/subdomains (e.g., XXX-ui.fly.dev vs XXX-api.fly.dev). The browser rejects the cookie with an 'invalid domain' error and no session is maintained.

were not accessible in js and in browser — Cookies are being set and sent with the next request. Outcome: The problem solved by adding `domain="blueberry.adefe.xyz"` to the cookie in response.

Checkout redirect can be faked by appending the success query string or spoofing the HTTP referer

MissingKeyMissing Key-Pair-Id query parameter or cookie value — {urn}/manifest/{derivativeurn}/signedcookies. Tension: I get the following error that suggest I'm missing a header.

the user is not properly logged out by the program, even after I click logout — on the `"Auth Required"` menu (`Auth.razor`). Tension: the expected logout behavior is only applied to the following pages. Outcome: This should resolve the loophole upon logout and user back navigation using the Blazor Identity options.

If at all I login in a new tab and close it. Tension: A Session needs to be maintained for authentication and authorization. Outcome: How can I achieve it?

Embedding a CPQ web app as an iframe inside Salesforce fails to persist authentication cookies/session for API calls. Login in a new tab isn’t recognized inside the Salesforce iframe, preventing authorized requests.

Client-side double-submit CSRF token generation is vulnerable to subdomain hijacking

Confusion about cookie authentication versus token authentication

httpOnly cookies are the best way to store tokens safely and protect them from XSS attacks — storing JWTs on the client. Tension: JavaScript won't be allowed to read httpOnly cookies. How would the client handle routes authentication? Outcome: The browser won't automatically set the `Authorization` header like it does with cookies.

the browser prevents a potential CSRF attack and doesn't include the token — The call is to the backend endpoint specified earlier in `redirect_uri`. Tension: I need a browser to include the `ASP.NET_SessionId` cookie in the request. Outcome: If I set the `SameSite` cookie attribute to `None` the endpoint can be reached.

I don't think CSRF protection for login forms are useful without also using a phishing attack. — login forms. Tension: They are relevant after a user logs in, in cases where there are forms that act on a user's behalf. Outcome: I wouldn't even generate a session cookie until after a user has logged in.

If I check 'Remember Me' in form, this add a cookie with name "REMEMBERME". Tension: I'm implementing custom authenticator. Outcome: your cookie is normal.

Fortify SCA reports that the following code is DOM XSS vulnerable — const returnUrl = sessionStorage.getItem('returnUrl') || '/'; window.location.href = returnUrl;. Outcome: Don't store a full URL, just store the necessary information.

The session identifier (req.sessionID) changed on every subsequent HTTP request from the React client to the Express server, preventing consistent session persistence.

Clicking the SSO button does not redirect the user to the /home page after authentication, and MSAL token generation does not occur. The app stays on the same page without completing the login flow.

After signing in, middleware redirection occurs, but the browser URL remains unchanged (e.g., it doesn't update to the intended callback/protected route).

The browser does not store the refresh token cookie returned by the Django Ninja login endpoint, even though the cookie appears in the response headers and the fetch call uses credentials: 'include'.

one is working without any credential or cookie[SessionId] but another one is not working — two api's in my spring mvc project which have identical structure. Tension: while calling using Postman or while hitting the APIs in browser/UI project.

even when correct username and password is provided, even in that case the control is redirected to login page instead of home page — I was implementing an authentication mechanism for my app.

A web app welcome/onboarding page was shown based on a stale auth session field and a browser localStorage fallback. — Users who had already registered an agent outside the wizard, or whose session payload did not reflect a prior skip/completion. Tension: could still be redirected to the welcome page. Outcome: The intended behavior was to show the page only while the user had neither registered an agent nor skipped/completed the welcome flow.

throws "Cookies can only be modified in a Server Action or Route Handler" — called from Next.js 15 Server Components (pages, layouts). Tension: The error appears intermittently — only when the session needs refreshing (controlled by `updateAge` config). Outcome: With `updateAge: 300` (5 minutes), it crashes every ~5 minutes for active users.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Cross-Domain Cookie Misuse - inErrata Knowledge Graph | Inerrata