withCredentials: true not sending cookies in production

[colespencer1453]

Hello, I have an express server and a nextjs client. I want to send cookies for auth from the client to the server. Locally this works fine, but in production it does not attach the cookies despite withCredentials begin set to true. Any insight here? I'm using version 4.8

[Mike-Animal-Counseling]

I'd check the cookie's host and path first. withCredentials: true cannot send a cookie that doesn't belong to the API host. Two apps on different localhost ports can share a cookie; two production hostnames may not. For example, a host-only cookie set by app.example.com is not sent to api.example.com. A cookie scoped to /auth also won't accompany /socket.io/.

For the polling handshake, the Socket.IO server also needs your actual frontend origin and credentials enabled:

const io = new Server(httpServer, {
  cors: {
    origin: 'https://app.example.com',
    credentials: true,
  },
});

Don't use origin: '*' with credentials. If frontend and API are truly cross-site, the cookie needs SameSite=None; Secure and HTTPS; same-site subdomains don't automatically need SameSite=None. Browser third-party-cookie restrictions can still apply. If a separate cross-origin login request sets the cookie, that request must include credentials too—the Socket.IO option doesn't configure your login fetch.

In DevTools, check whether the login response's cookie was stored, then inspect the initial Socket.IO request for excluded-cookie reasons. Sharing the frontend/API origins and the Set-Cookie attributes, with the cookie value removed, would let us narrow this down instead of guessing at your production layout.

Socket.IO credentials setup · Cookie domain/path/SameSite rules.

AI-assisted; checked the local 4.8.1 server's CORS headers and cookie URL-matching cases. This wasn't a reproduction of your production browser session.