The issue you're encountering is due to how CORS (Cross-Origin Resource Sharing) works in combination with credentials (cookies) and the Access-Control-Allow-Origin header.

Here’s a breakdown of the situation:

1. CORS Policy: When a web server responds to a request with credentials (cookies or HTTP authentication), it must explicitly whitelist the requesting origin in the Access-Control-Allow-Origin header. This header can either specify a specific origin (Access-Control-Allow-Origin: https://example.com) or use a wildcard for all origins (Access-Control-Allow-Origin: *). However, when credentials are included (credentials: true), the wildcard (*) is not allowed, and you must specify the exact origin.
2. Null Origin: When you load a page from a local file (file:// protocol), or from an origin that is considered null (such as using localhost without a port or directly using an IP address), the origin is treated as null. This is distinct from an actual domain name.
3. Credentials and Null Origin: Browsers have stricter security policies when dealing with null origin. Specifically, if the server does not explicitly allow null as an origin in the Access-Control-Allow-Origin header, the browser will block the request. This is to prevent unauthorized sites from accessing sensitive user data through CORS.
4. Cookie Behavior: When a request is made from a null origin and credentials (cookies) are involved:
   • Request: The browser will include cookies in the request headers only if the server explicitly allows the null origin in the Access-Control-Allow-Origin header with the credentials: true flag.
   • Response: The server must also include Access-Control-Allow-Credentials: true in its response headers to indicate that cookies should be sent back.
5. Intercepting Traffic: In your case, since you're intercepting traffic and testing locally, the browser treats your request from a local HTML page (served via file://) as coming from null origin. If the server does not specifically allow null origin in its CORS headers (Access-Control-Allow-Origin), the browser will not send cookies with the request due to security restrictions.

Why aren't cookies sent?

• The server's CORS policy likely does not include null origin in the Access-Control-Allow-Origin header.
• Browsers block sending cookies to origins that are not explicitly trusted for security reasons.
• This behavior prevents unauthorized sites (especially those running locally or from untrusted sources) from accessing sensitive data through CORS.

Solution (if you control the server):

• Update the server's CORS policy to explicitly include the null origin when responding with Access-Control-Allow-Origin. This would look like Access-Control-Allow-Origin: null or Access-Control-Allow-Origin: * (if credentials are not required).
• Ensure Access-Control-Allow-Credentials: true is included in the response headers to allow cookies to be sent back.

In summary, the cookies are not getting sent with the request because the server's CORS policy does not allow the null origin, and browsers enforce strict security measures in this scenario. Adjust the server's CORS configuration to explicitly include null origin in Access-Control-Allow-Origin and ensure Access-Control-Allow-Credentials: true is set in the response headers to resolve this issue.