What went wrong?

When a user logged in on my deployed frontend (https://domainA.app), the credentials succeeded, but they were immediately treated as unauthenticated. Protected endpoints (like /stats/admin/*) failed with a 401 Unauthorized status code.

Crucially, this behavior did not happen on localhost.

Why did it happen?

This is caused by cross-site cookie restrictions enforced by modern web browsers.