We're doing authentication by sending a JWT via an httpOnly cookie.
(client sends credentials, server answers with a token cookie, client attaches it to all subsequent requests).
Due to some constraints, we need to deploy backend and frontend services on different domains. Thus, our token cookie that worked wonderfully on localhost, got blocked by the browsers as a 3rd party cookie.
Is there any way to use httpOnly cookies to transfer the JWT between different domains?
Or is there any other way to do authentication when the BE and FE reside on different domains?
Session storage and local storage were recommended in this article:
but we would like to avoid it for their XSS vulnerability.