This is a dev environment. I am running the backend API (dotnet) from https://localhost:5001, and the front end (nextjs/react) from http://localhost:3000. A login request is sent to the back end, it generates a JWT sends it as an HttpOnly cookie in the response header, which is received successfully by the front end. However, the browser never stores it in the Cookies. See the screen shots.

The backend has CORS set like this:

if (builder.Environment.IsDevelopment())
{
    options.AddPolicy("AllowAllHeaders",
       builder =>
       {
           builder.SetIsOriginAllowed(origin => true)
                  .AllowAnyHeader()
                  .AllowCredentials()
                  .AllowAnyMethod();
       });
}

with the header set like this:

HttpContext.Response.Cookies.Append("token", result.AccessToken,
    new CookieOptions
    {
        Expires = result.ValidTo,
        HttpOnly = true,
        Secure = true,
        IsEssential = true,
        SameSite = SameSiteMode.None
    });

I think the problem is related to the different back/front IPs but thought that this configuration should work around that. Why is the browser not setting that cookie? Is there a way to get it to? As far as I understand, this won’t be an issue in production, but I need to be able to test it locally.