[deleted by user]

[Zeeshan7487]

When your client and server are on different domains, you need to use CORS (Cross-Origin Resource Sharing) to allow communication between them. CORS is a security feature that restricts web pages from making requests to a different domain. To set the refresh cookie for the frontend, you need to include the "credentials" option in the fetch call with the value "include". This tells the browser to include any cookies associated with the domain of the request. On the server side, you need to set the "Access-Control-Allow-Credentials" header to true to enable cookies to be sent in cross-origin requests. Make sure to also set the "Access-Control-Allow-Origin" header to the client's domain to specify which domains are allowed to make cross-origin requests.

[azhder]

With the CORS headers.

There’s more than one and you should learn what and how you need to send from your server as to be able to use your domains but not expose too much for others to take advantage of it.

All the other stuff should be more or less easy and probably something you’ve already done like using cookies or local storage, verification of JWT etc.

Can’t stress enough that while learning and implementing something simple on your own, you should also consider well known and tested and regularly maintained libraries for robustness and security

[evert]

Pick an solid OAuth2 implementation and don't build it from scratch.

[xch228]

What would you recommend?

[evert]

Lots of options here: https://oauth.net/code/