So I have a frontend running at https://site.example.com, with a "Sign in with google" button. The button uses the data-login_uri attribute to send the confirmation POST request to my backend at https://api.site.example.com.
Now the guide states that we should compare the g_csrf_token in the request body with the one in the cookie, only my backend is not receiving the cookie value. I checked the network logs in chrome, and the cookie has been filtered out with the following message next to the domain property:
This cookie was blocked because neither did the request URL's domain exactly match the cookie's domain, nor was the request URL's domain a subdomain of the cookie's Domain attribute value.
But that doesn't make any sense to me, as the requests URL (api.site.example.com) should be a subdomain of the cookie's Domain value (site.example.com), and thus the cookie should be valid.
I've tried using data-state_cookie_domain to set the domain to api.site.example.com, site.example.com and example.com, but that appears to be only for the "One Tap" ui and had no effect. This issue in the google-auth-library-nodejs repo directed the author here, but I wasn't able to find a related question covering the scenario.