I've been working a lot lately with Angular 20 front ends and Laravel + Sanctum back end APIs. One big issue I came across was getting my session cookie sent to the back end when making requests using Angular's HttpClient. The issue didn't show up in production where I had Laravel's CORS config setup working. But on my local dev setup, I couldn't get authorization cookies in the requests. The responses all had a set-cookie header, the requests were properly prepared with the withCredentials: true option (using an Angular interceptor). I ended up using an Authorization: bearer <token> solution. It worked, but is more likely to be leaked.

Finally, I solved the issue. On the dev server, Angular uses ng serve, running by default on localhost:4200. Laravel's php artisan serve uses 127.0.0.1:8000. Cookies don't like that. They are domain aware and only want to stay on the domain they were issued from. Unlike CORS allowed origins, they don't care about protocol or port, but like CORS, cookies don't see localhost as the same domain as 127.0.0.1.

So, that was the problem. Cookies can easily dismiss sub-domain differences (api.a.com works with www.a.com) so that's why production was okay - it's the same domain, just with a sub-domain difference. The fix was simple. I set in my local dev's Laravel .env file to use

SESSION_DOMAIN=localhost 
SECURE_COOKIE=false 

Then I started Laravel with php artisan serve --host localhost and started ng serve (default is localhost). Finally all the credentials (err, session cookie) went back and forth.