I'm creating a Next JS application (hosted on Netlify) and using next-auth to handle authentication. My backend api (uses Express) is hosted on Google App Engine. The HttpOnly cookies are being attached and sent while testing on localhost. However, while in production, the HttpOnly cookies are not being sent when fetching from the external backend api. I have been doing credentials: 'include' when trying to fetch from the frontend, and on my backend, I've whitelisted the correct urls.

Here's my corsConfig for my backend:

const corsConfig = {
  credentials: true,
  origin: function(origin, callback) {
    if (whitelist.indexOf(origin) === -1 || !origin) {
      let message = "The CORS policy for origin:" + origin + "is not configured";
      return callback(new Error(message), false);
    }
    return callback(null, true);
  },
};
app.use(cors(corsConfig));