I have 2 angular applications: csrfexample.com:4200 and attacker.csrfexample.com:4201. Both these application connect to a node server: csrfexample.com:3000.

When I login into the csrfexample.com:4200 application, the node server: csrfexample.com:3000 sets a session cookie like below:
res.cookie(“session-token”,”mysession”,{httpOnly:true,secure:false,sameSite:’lax’});

This cookie gets set in the Application->cookies of csrfexample.com:4200 as expected.

When I try to do a POST request to the node server from attacker.csrfexample.com:4201, why is this cookie included in the request ? I dont even see the cookie in the Application —> cookies of attacker.csrfexample.com:4201

From my knowledge, cookies are not shared across subdomains if the domain attribute is not set. That is happening as expected. The cookie doesnt appear in the Application —> cookies of attacker.csrfexample.com:4201. But how is the cookie then included in the requests ?

I was not expecting the cookie to be sent in any request initiated from attacker.csrfexample.com:4201. I am looking for an explanation why its happening ?