About what you've mentioned (CORS issues) - if I'm not mistaken, our client sends a request to Ory to fetch the session, leading to a Set-Cookie in the response. If the client & Ory are not on the same domain, that won't work, right? To give a concrete example, our client sits at app.merlinn.co (hosted by Vercel). In our client code we do this:

ory
      .toSession()
      .then(({ data }) => {
        // User has a session!
        setSession(data);
        ory.createBrowserLogoutFlow().then(({ data }) => {
          // Get also the logout url
          setLogoutUrl(data.logout_url);
        });
      })
      .catch((err) => {
        console.log("No session found", err);
      })
      .finally(() => {
        setLoading(false);
      });

This sets the cookie of Ory, which allows the browser to send the cookie to our server (because they're on the same domain. Our server sits on api.merlinn.co) In our server, we extract this cookie in an Express.js middleware and do this:

export const checkAuth = async function (
  req: Request,
  res: Response,
  next: NextFunction,
) {
  try {
    const { data: session } = await ory.toSession({
      cookie: req.header("cookie"),
    });

    req.session = session;
    next();
  } catch (error) {
    next(error);
  }
};

Do you have an idea in mind of making it work without custom domain maybe? 🧐

To give more context, this is our project. It's an open source one. We're currently working on building our Cloud edition, which led us to investigate this subject.

I will DM you on options for the Production plan for early stage startups