Q:

Http cookie not sent even though CORS is configured to allow access

I have a web app that needs to access siteA and siteB (both are under my administration).  After the web app talks with siteA (and gets a cookie from siteA) and it jumps to siteB,  it needs to make a call with siteA, but the http request doesn't contain any cookie even though I configured (via cors) siteA to trust siteB and allow credential.
Have been googling and reading documents both in SO and other sites on this, however, I just can't get the cookie to be sent in the HTTP request. Here is the javascript that makes the API call with siteA (running in a page on siteB, browser is chrome)
await (await fetch("http://siteA/api/1/greeting", {credentials: 'same-origin'})).text()
"Greetings from Spring Boot!"

Here is the HTTP request sent by the above javascript.
GET /api/1/greeting HTTP/1.1
Host: siteA
Connection: keep-alive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4117.2 Safari/537.36
Accept: */*
Origin: https://siteB
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Here is the response:
HTTP/1.1 200
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Access-Control-Allow-Origin: http://siteB
Access-Control-Allow-Credentials: true
Set-Cookie: jname=joe; HttpOnly
Content-Type: text/plain;charset=UTF-8
Content-Length: 27
Date: Sun, 26 Apr 2020 17:58:48 GMT
Keep-Alive: timeout=60
Connection: keep-alive

Any help or ideas are appreciated!
PS1: When I refresh a web page of siteA, I can see (from dev console) that the request has the cookie. 
PS2: tried to use credentials: 'include' in the javascript snippet, it didn't work either.

A:

Can you try changing your code above to:
await (await fetch("http://siteA/api/1/greeting", {credentials: 'include'})).text()
See here: https://javascript.info/fetch-crossorigin

