title: When i set to cookie from dotnet web. api, it is not added to cookies in client side
body: <p>i have a question. When i set to cookie from dotnet web. api, it is not added to cookies in client side. I find out in google that i have to change https to http and then it is has to added credential:&quot;include&quot; to header in react app. When i did this yes, cookie work. But I cant  project as http, because most web sites are https. Https are secure. But i cant handle cookies in client side when i use web api as https, what should i do? How can i use cookies in https? Here is my Startup.cs</p>
  <pre><code>    public IConfiguration Configuration { get; }
  
      // This method gets called by the runtime. Use this method to add services to the container.
      public void ConfigureServices(IServiceCollection services)
      {
          services.AddDbContext&lt;ApplicationDbContext&gt;(options=&gt;
                  options.UseSqlite(&quot;Data Source=webapi.db&quot;));
          services.AddIdentity&lt;User,IdentityRole&gt;().AddEntityFrameworkStores&lt;ApplicationDbContext&gt;().AddDefaultTokenProviders();
  
         services.Configure&lt;IdentityOptions&gt;(options =&gt;
  {
      // Password settings.
      options.Password.RequireDigit = true;
      options.Password.RequireLowercase = true;
      options.Password.RequireNonAlphanumeric = true;
      options.Password.RequireUppercase = true;
      options.Password.RequiredLength = 6;
      options.Password.RequiredUniqueChars = 1;
  
      // Lockout settings.
      options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(5);
      options.Lockout.MaxFailedAccessAttempts = 5;
      options.Lockout.AllowedForNewUsers = true;
  
      // User settings.
      options.User.AllowedUserNameCharacters =
      &quot;abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+&quot;;
      options.User.RequireUniqueEmail = false;
      });
  
      services.ConfigureApplicationCookie(options =&gt;
      {
          // Cookie settings
          options.Cookie.HttpOnly = false;
          options.ExpireTimeSpan = TimeSpan.FromMinutes(5);
          
          options.LoginPath = &quot;/Identity/Account/Login&quot;;
          options.AccessDeniedPath = &quot;/Identity/Account/AccessDenied&quot;;
          options.SlidingExpiration = true;
      });
          services.AddAuthentication(x=&gt;
          {
              x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
              x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
          })
          .AddJwtBearer(x=&gt;
          {
          
              x.RequireHttpsMetadata =false;
              x.SaveToken= true;
              x.TokenValidationParameters = new TokenValidationParameters
              {
                  ValidateIssuerSigningKey = true,
                  IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(&quot;My key is very important and safe&quot;)),
                  ValidateIssuer = false,
                  ValidateAudience=false,
                  RequireExpirationTime=true
              };
              
          });
  
  
          services.AddCors(option=&gt;
          option.AddDefaultPolicy(builder=&gt;
                  builder.AllowAnyHeader()
                          .AllowAnyMethod()
                          .AllowAnyOrigin()
                  ));
          services.AddScoped&lt;IJwtService,JwtService&gt;();
  
          services.AddControllers();
          services.AddSwaggerGen(c =&gt;
          {
              c.SwaggerDoc(&quot;v1&quot;, new OpenApiInfo { Title = &quot;WebApi_.Net6_jwt&quot;, Version = &quot;v1&quot; });
          });
      }
  
      // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
      public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
      {
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
              app.UseSwagger();
              app.UseSwaggerUI(c =&gt; c.SwaggerEndpoint(&quot;/swagger/v1/swagger.json&quot;, &quot;WebApi_.Net6_jwt v1&quot;));
          }
  
          app.UseHttpsRedirection();
  
          app.UseRouting();
          app.UseCors();
  
          app.UseAuthentication();
  
          app.UseAuthorization();
  
          app.UseEndpoints(endpoints =&gt;
          {
              endpoints.MapControllers();
          });
      }
  }
  </code></pre>
  <p>}</p>