Use cookies from external backend API

[FlawTECH]

Hi, I'm new to Nuxt 3 and SSR as a whole and I'm wondering if I'm doing something wrong.

My current setup is a frontend with Nuxt 3 (SSR) and a backend API using fastify.
I only want to use Nuxt 3 as the frontend and all the backend logic is handled by fastify. My understanding is that if I use SSR, the only thing Nuxt does is pre-render views as a sort of "cache". That is perfectly fine and what I want.

Now, I'm using JWT + Refresh tokens for authentication, and I'm seeing unexpected behavior.
Note that Nuxt is listening on port 3000 and fastify is listening on port 3005.

When I make a POST call to http://localhost:3005/api/v1/users/login. This returns a JWT Token in response body and a refresh token in the headers (through Set-Cookie). So, in Nuxt, since this is user interaction, I make the following call:

const result = await $fetch.raw('/users/login', {
  baseURL: useRuntimeConfig().public.apiBase,
  method: 'POST',
  body: { email, password }
})
console.log(Array.from(result.headers.keys()))

I'm using $fetch.raw since I want to get the cookie, but the only cookies I see are Content-Length and Content-Type. At first I thought it was because my cookie is sent with HttpOnly, but even disabling that doesn't seem to work.

In Chrome Network's tab, I can see the request being made, and the Set-Cookie header is visible. However, under Application > Cookies, the list is empty. I tried with ssr: false, same behavior. If I make another request on my API, the Cookie header is not present, so it's probably discarded by Nuxt.

I even tried making a temporary GET endpoint with a dummy cookie: when visiting the endpoint directly with my browser, the cookie is correctly set, and sent with every request. However, with Nuxt, the cookie is also sort of "ignored".

What am I doing wrong ?

Thank you.

[FlawTECH]

Well, looks like I was missing credentials: 'include' in my $fetch options.
No clue if this has an impact with ssr: true, so keeping it open for now. Does Nitro do anything with that ? Am I at risk of exposing cookies to all my users ?