Spring Boot JWT cookies not sent cross-site from React frontend on Vercel -> Render backend (403 Forbidden)
Summary A production outage occurred where a React frontend on Vercel could not authenticate against a Spring Boot backend on Render, resulting in 403 Forbidden errors. The root cause was misconfigured SameSite cookie attributes and missing CSRF protection. While SameSite=None was intended, it requires the Secure attribute and explicitly requires SameSite=None (case-sensitive). More critically, disabling … Read more