Why is cookie not getting sent to server - node.js

Question

I have a nodejs express application hosted on a server. Basically, I have two endpoints:
POST /session - this is where I send back the cookie
GET /resource - this is where I check if the cookie is sent back, if not I send back 401 not found, like so
On the frontend, which is on a different domain (let's say a newly generated angular-cli application which is running on htpp://localhost:4200), I try to call the /session API, which returns the cookie header, but a consecutive /resource API call will not send the cookie back to the server. What am I doing wrong?
Serve code is as follows:
// server.js
const express = require("express");
const app = express();
const cookieParser = require("cookie-parser");
const cors = require("cors");
app.use(cors());
app.use((req, res, next) => {
console.log(req.method, req.url, JSON.stringify(req.headers, null, 2));
next();
});
app.use(cookieParser());
app.get("/", (req, res) => {
res.send({ status: "running" });
});
app.post("/session", (req, res) => {
const cookie = `AuthSession=token; Path=/;`;
res.setHeader("Set-Cookie", cookie);
res.send({ status: "logged in" });
});
app.get("/resource", (req, res) => {
const authSessionCookie = req.cookies && req.cookies["AuthSession"];
if (!authSessionCookie) {
res.sendStatus(401);
return;
}
res.send({ resource: "resource" });
});
const listener = app.listen(process.env.PORT, () => {
console.log("Your app is listening on port " + listener.address().port);
});
This is the cookie sent back by the /session API:
Angular code as follows:
export class AppComponent {
constructor(private readonly httpClient: HttpClient) {
this.httpClient
.post("https://uneven-glowing-scorpion.glitch.me/session", {})
.subscribe(resp => {
console.log(resp);
this.httpClient
.get("https://uneven-glowing-scorpion.glitch.me/resource")
.subscribe(resp => {
console.log(resp);
});
});
}
}
As you can see the server is available at https://uneven-glowing-scorpion.glitch.me for testing purposes.

Answer 1

http://localhost:4200 and https://uneven-glowing-scorpion.glitch.me are not the same domain, therefore no cookie gets sent. It's really just that simple. There is no way around that with cookies. Cookies cannot cross domains. That's what makes them secure.
The reason your HTTP call works with Postman is because that application is very forgiving in these situations; browsers are not. There are many questions about this on SO.