Sessions, cookies and CORS

A cookie session crosses three boundaries: CORS decides whether the browser lets a page use credentials, cookie attributes (Path, HttpOnly, SameSite) decide where the cookie travels and who can read it, and the CSRF token has to be read by script and echoed in a header. Break any one and sign-in looks fine while every later request fails. Reproduce with the network tab: check Set-Cookie flags, the request's Cookie header and the response's Access-Control-* headers.