I have two different domains, and trying to share data between the two.

My plan was to have domain-1.com make a GET request to domain-2.com, which would use their logged-in status on domain-2.com.

domain-2 has appropriate HTTP headers:

response.headers["Access-Control-Allow-Origin"] = request.headers["Origin"]
response.headers["Access-Control-Allow-Credentials"] = "true"
response.headers["Access-Control-Allow-Methods"] = "GET, OPTIONS"
response.headers["Access-Control-Allow-Headers"] = "Content-Type"

if request.method == "OPTIONS"
    return head :ok
end

return render json: {user: user}, status: 200

domain-1 makes a fetch request:

fetch('https://domain-2.com/endpoint', {
    method: 'GET', 
    mode: 'cors', 
    credentials: 'include'
});

I can see the OPTIONS request shows 200 OK, and the GET request shows a 200.

But there is no Cookie header sent.

Is this because these are two different domains?

Why does this work when I have www.domain.com making requests to api.domain.com which contain cookies set on api.domain.com?