Looking for some help with the Google Signin Implementation:

Why am I missing the cookies for g_csrf_token listed as part of the server side response when I am using the data-callback tag in my Google Sign in button?

Thanks for your help!!

Response passed to data-callback function handleCredentialResponse(response)

{
    "clientId": "<client id>",
    "credential": "<jwt token base64encoded>",
    "select_by": "btn"
}

HTML and JS Code

<div id="g_id_onload" 
    data-client_id="<client id>"
    data-context="signin"
    data-ux_mode="popup"
    data-nonce="randomstring"
    data-auto_prompt="false"
    data-callback="handleCredentialResponse">
</div>

<div class="g_id_signin" class="button_item"
    data-type="standard"
    data-shape="pill"
    data-theme="filled_blue"
    data-text="signin_with"
    data-size="large"
    data-logo_alignment="left">
</div>

...

function handleCredentialResponse(response) {
    console.log(response); // This prints the JSON objet listed in the response above in the answer {clientId:"", credential:"", selected_by:""}
    postData('/authorize', response )
        .then(data => {
            console.log('User authorized:', data);
            
        })
        .catch(error => {
            console.error('Error:', error);
        });
}
async function postData(url = '', data = {}) {
    // Default options are marked with *
    const response = await fetch(url, {
        method: 'POST', // *GET, POST, PUT, DELETE, etc.
        mode: 'cors', // no-cors, *cors, same-origin
        cache: 'no-cache', // *default, no-cache, reload, force-cache, only-if-cached
        credentials: 'same-origin', // include, *same-origin, omit
        headers: {
        'Content-Type': 'application/json'
        // 'Content-Type': 'application/x-www-form-urlencoded'

        },
        redirect: 'follow', // manual, *follow, error
        referrerPolicy: 'no-referrer', // no-referrer, *no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, unsafe-url
        body: JSON.stringify(data) // body data type must match "Content-Type" header
    });
    return response; // parses JSON response into native JavaScript objects
}