I have been trying to get CORS/CSRF working on my local and I found this weird issue that unless I set CSRF_COOKIE_DOMAIN to localhost as per this answer and I have no idea why its working.

Reading up on it on MDN and MDN basically states that the current document url will be used if not set explicitly.

Whats the correct reason for not saving cookies unless cookie domain is specified? for reference: my frontend url is http://localhost:5173 and I tried combinations of 127.0.0.1:5173 to get it working but it didnt without it.

Here are my settings for Django

base.py

SESSION_COOKIE_HTTPONLY = True
CSRF_COOKIE_HTTPONLY = False
CORS_ALLOW_CREDENTIALS = True
CSRF_COOKIE_SECURE = True
X_FRAME_OPTIONS = "DENY"

and local.py for local dev

CSRF_TRUSTED_ORIGINS = ["http://localhost:5173", "http://127.0.0.1"]
CSRF_COOKIE_DOMAIN = "127.0.0.1:5173"
# CSRF_COOKIE_SAMESITE = "None"
# SESSION_COOKIE_SAMESITE = "None"
CSRF_COOKIE_SECURE = True
# django-cors-headers
CORS_ALLOWED_ORIGINS = [
    "http://*.localhost:5173",
    "http://*.127.0.0.1:5173",
    "http://localhost:5173",
    "http://127.0.0.1:5173",
]
CSRF_COOKIE_DOMAIN = "localhost"