I have my frontend running on “https://example.com” and backend running on “https://api.example.com”.

From backend, the login endpoint “https://api.example.com/auth/login” is returning refresh token in response headers as below (i can see it in browser network tab):

Access-Control-Allow-Origin:https://example.com
Cache-Control:no-cache, no-store, max-age=0, must-revalidate
Set-Cookie:  refreshToken=eyJhbGciOiJIUzI1NiJ9...; Path=/auth/refresh; Domain=example.com; Max-Age=31536000000; Expires=Thu, 23 Oct 3023 00:57:41 GMT; Secure; HttpOnly; SameSite=Lax

other headers....

But when frontend makes the call to refresh access-token then request doesn’t contain the refresh token. Browser doesn’t append the token in the request and server rejects it with 403. Below are the request details for refresh token:

Request URL:https://api.example.com/auth/refresh
Request Method:POST
Status Code:403 Forbidden
Remote Address:xxxxx
Referrer Policy:strict-origin-when-cross-origin

Request Headers:

:authority:api.example.com
:method:POST
:path:/auth/refresh
:scheme:https
Accept:application/json, text/plain, */*
Accept-Encoding:gzip, deflate, br, zstd
Accept-Language:en-GB,en-US;q=0.9,en;q=0.8
Content-Length:0
Origin:https://example.com
Priority:u=1, i
Referer:https://example.com

Why browser is not appending or storing the refresh token when it is coming from same sub-domain and domain attribute is also set in refresh-token cookie?

The cookie is also not visible in browser’s dev tool.