I have my back-end Express.js server that has sign in function. After user sign in, he gets 2 tokens - access token and refresh token. What I want to do, is to make return from server refresh token as httpOnly cookie.

Here is a peace of code of this function:

const { refreshToken, accessToken } = await jwtService.updateTokens({
  userId: client.id, username: client.username
}, { transaction })
logger.info(`Client ${client.email} has been successfully signed in!`)

await transaction.commit()
return res
  .status(200)
  .cookie("refreshToken", JSON.stringify(refreshToken), { httpOnly: true, secure: false })
  .json({ accessToken, reopening: reopening ? client.username : null })

Basically, browser just doesn't set this cookie as httpOnly and doesn't set it at all, actually. So, I was trying to ping this endpoint with postman, and it works:

In reponse body I have access token and in httpOnly cookie I have this refresh token.

So, the problem is, why browser doesn't save it? I have found a couple of solutions and all of them were about cors and axios credentials. I use 2 express servers - 1 is for normal back-end and 1 is for front-end.

Here is how "path" from front-end to back-end looks like:

Sign in function that send request to front-end express server:

const api = axios.create({
  baseURL: apiUrl,
  headers: {
    'Content-Type': 'application/json'
  }
})

export const signIn = async payload => {
  try {
    const { data } = await api.post('s-i', payload)
    return data
  } catch (e) {
    return e.response.data
  }
}

Front-end express server sends request to actual back-end:

const api = axios.create({
  baseURL: process.env.NODE_ENV === "development" ? process.env.PNB_API_DEV : process.env.PNB_API_PROD,
})

const router = Router()

router.post('/s-i', async (req, res) => {
  try {
    const { data } = await api.post('/sign-in', req.body)
    res.json(data)
  } catch (e) {
    return res.status(e.response.status).json(e.response.data)
  }
});

And then that function that was at the very begging.

So, how I make browser get and save this httpOnly cookies? If it's really about credentials or cors where should I put those settings?

PS

Back-end port - 3001 and front-end port - 8010.