I have a problem with setting a cookie on the response from the lambda function.

There are two pages (uploaded on s3 bucket) - login and validate.

On my login page I do some calls to 3rd api and at the end of that I return a cookie.

{
  statusCode: 200,
  headers: {
    'Access-Control-Allow-Origin': 'HERE GOES DOMAIN WITH LOGIN.HTML AND VALIDATE.HTML FILES',
    'Access-Control-Allow-Credentials': true,
    'Access-Control-Allow-Headers': 'Content-Type,X-Amz-Date,X-Amz-Security-Token,Authorization,X-Api-Key,X-Requested-With,Accept,Access-Control-Allow-Methods,Access-Control-Allow-Origin,Access-Control-Allow-Headers',
    'Access-Control-Allow-Methods': 'GET,POST,PUT,DELETE,HEAD,OPTIONS',
    'Set-Cookie': "sess_id=key;Expires=SOME_VAL;Path=/"
  }
}

I do see that cookie in developers tool in response headers but its not getting set up for some reason. document.cookie result with empty string.

So I set that up manually but when I do another reqeust on my second page (validate) to API gateway (lambda for validating that session) the session is not included in the request headers.

I use fetch web api and credentials:"include" with each request but without any success.

Any tips? Thanks.