Quote simple, ANY cookie MUST come from the domain the request-response is made You CANNOT obtain a cookie from ANY different server domain to the client!!!!! The response URL domain in the client must be the domain and path level for the cookie! See RFC 6265 https://datatracker.ietf.org/doc/html/rfc6265