Login Cookie Missing in Production

Treat login as four stages: the server issues a cookie, the browser accepts it, the browser sends it on the next request, and the server recognizes the session. A failure at any stage can look like “the cookie disappeared.”

Start with the login response

Inspect the actual response in the browser's Network panel, including redirects. Is a Set-Cookie header present? Does the browser show a rejection reason?

If the server never issued the cookie, investigate the authentication callback and proxy configuration before changing browser settings.

MDN's Set-Cookie reference explains attributes such as Domain, Path, Secure and SameSite. These determine different parts of cookie behavior.

Follow the cookie across requests

Stage	Evidence
Issued	Header on the actual response
Accepted	Browser storage and rejection diagnostics
Sent	Cookie header on the next relevant request
Recognized	Server session lookup result

A cookie visible in storage can still be excluded from a request. A cookie sent correctly can still reference an expired or missing server session.

Do not expose session values in screenshots or logs. Record names and attributes, with values redacted.

Check production differences

Compare HTTPS usage, hostnames, subdomains, callback URLs and frontend/API origins. An attribute suitable for localhost may not describe the production deployment.

Cross-site and cross-origin are not identical concepts. Review the browser's actual classification and the intended request flow rather than adding SameSite=None everywhere.

For a cross-origin fetch, confirm credential handling on both client and server. Browser privacy policies can also restrict third-party cookies independently of a permissive CORS response.

Inspect the proxy boundary

If TLS terminates at a proxy, the application needs a correct and trusted understanding of the external request. Configure framework-specific proxy handling according to its documentation.

Do not trust arbitrary forwarded headers from every caller. A proxy configuration fix should describe which proxies are trusted and how the public scheme and host are determined.

If several application instances handle requests, confirm they share or can verify the session state as intended. A valid cookie cannot repair an instance that lacks the corresponding session.

Test the real journey

Use a fresh browser session. Complete login, follow the redirect, load a protected page, refresh and log out. Repeat on the actual production hostname and a supported browser.

Keep each stage's evidence. If a coding assistant suggests weakening all cookie attributes, use this trace to demand a specific diagnosis. See the AI coding workflow guide for evaluating changes through observable behavior.

Related troubleshooting

• API Works in curl but Fails in the Browser
• API Key Committed to Git: What to Do Next

This guide draws on the linked documentation. Examples are illustrative unless explicitly identified as measured results.