bored-father-9006
02/05/2025, 1:39 PMbrief-egg-61061
02/05/2025, 1:39 PMbrief-egg-61061
02/05/2025, 1:40 PM<https://www.my-evil-app.com>
and the server responds with Set-Cookie: google_session=1234; domain=<http://google.com|google.com>
, the browser rejects the cookie." This means that even if you're using the Ory Tunnel on localhost, it cannot set cookies for a different domain due to browser security restrictions. Furthermore, the [Cookie settings documentation](https://www.ory.sh/docs/kratos/guides/configuring-cookies) emphasizes: "HTTP Cookies aren't port specific. If a cookie is set on <https://mydomain.com:1234>
it's also valid for <https://mydomain.com:4321>
and <https://mydomain.com>
." This reinforces that while the Ory Tunnel can help with local development by allowing your app and Ory to run on the same domain (localhost), it cannot bypass the fundamental domain restrictions for cookie setting imposed by web browsers.