nop .. I have to ?

U don’t. The library should do it by itself

How can I verify ?

Are you using the supertokens-website package?

yes, with angular 8

So, just confirming, when u call an API that has createNewSession function in it, that API doesn’t return headers having set-cookies?

Oh. And are you using with out without express?

Or*

no sorry, I use createNewSession, the browser save sIdRefreshToken and yes, I use express

Okay. So the frontend is getting the tokens.

I think so

So in chrome, can u see the list of cookies for localhost and send that info? You can do so by right clicking, inspect, application, cookies. And you should see a sAccessToken

Do u see that?

yes,

Alright, and can you share the sAccessToken’s path, secure flag and domain (as they r stored in this location)

Basically everything for sAccessToken except for it’s value

Its*

I assume that tick is for httpOnly flag right?

Yes,

oh!!

Does it work now?

I retry, it's work 😱

Why ?,

Yea. Ok. I thought this would happen

Cause when u had changed the config, u must have not created a new session

The old cookies must have still been for https

Which would not work since u don’t have https://localhost

And now when u created a new session, those have secure flag as false (since u set secure to false in config). And those go with http://localhost

So now any new session should work.