I added withCredentials
to my front-end request, even though I deployed the front and back ends separately.
assume that the front end is deployed at web.xxx.com
and that the back end is deployed at service.xxx.com
I define all api as web, so I can authenticate users by setting cookie, and I can temporarily store data in session in back-end code.