Cookie not being added to session - node.js

Question

I'm developing a Webapp using React-Redux, making request to a API in nodejs in a different domain.
To login the user, I send the credentials to my API, which validates them and sends me back as JWT. I'm trying to do this by using the ExpressJS, so in the login path in my API I have:
res.cookie("my_token", token);
The problem is that the Cookie is not being added to the session. Using Mozilla, I can see that the Set-Cookie property it is in the headers with the right cookie, but it doesnt show up in my resources.
I also made some tests with DHC, using DHC the Cookie is successfuly stored in my session cookies.
I have
res.header("Access-Control-Allow-Origin", "*");
res.header("Access-Control-Allow-Credentials", true);
res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
in both my website and api. In the website I'm using react module axios to make the requests. In the api I'm using cookie-parser to handle the cookies. These are my middlewares (both api and app):
app.use(function(req, res, next) {
res.header("Access-Control-Allow-Origin", "*");
res.header("Access-Control-Allow-Credentials", true);
res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
next();
});
const cookieParser = require("cookie-parser");
app.use(cookieParser());
const bodyParser = require("body-parser");
app.use(bodyParser.json({limit: '50mb'}));
app.use(bodyParser.urlencoded({limit: '50mb', extended: true}));
const morgan = require("morgan");
app.use(morgan('dev'));
This is my request:
axios.post(`${ROOT_URL}/login`, creds)
.then(res => { /*...*/ })
.catch(err => { /*...*/ });
This is my response:
res.cookie("session_token", token, { domain: ".mydomain.com" }).send(response);

Answer 1

I have a similar problem with Angular code, Thing I dids to solved
From the client you need enable withCredentials I thing axios should have some option to enable it
From your backend res.header("Access-Control-Allow-Origin", "*"); is not enough
You can do something like this
res.header("Access-Control-Allow-Origin", req.header('Origin'));
Because you need return a host not an asterisk, this is only for development purposes, I recommend you change this to some static url later