I have django rest deployed on Heroku with domain like: api.herokuapp.com.
On front end I have React with domain like: dashboard.mydomain.com
Settings for axios are:
axios.defaults.withCredentials = true;
axios.defaults.xsrfCookieName = "csrftoken";
axios.defaults.xsrfHeaderName = "X-CSRFToken";
Locally everything works fine.
In production:
Making POST request I am getting 403 error: CSRF Failed: CSRF token missing or incorrect
Seeing at request there is cookie sent: 
but it's not sending X-CSRFToken header.
Locally it's sending the header normally.
I suspect it could be either because production is HTTPS or because domains are different, but I don't know much about it.
What could be the reason?