cors

The Set-Cookie header is sent, but the browser rejects or never stores it. Fix SameSite=None without Secure, missing credentials: 'include' plus AllowCredentials, consent policy, and late Append calls.

A complete guide to CORS for a bearer-token API in ASP.NET Core 11: the correct UseCors ordering relative to authentication, why a bearer token in the Authorization header is not a CORS credential, why AllowAnyHeader works but a manual wildcard does not cover Authorization, and how to keep preflight from failing.