Set-Cookie headers are missing when Azure Static Web App proxies requests to linked Azure Function App

I have a Static Web App (blabla-web-dev) linked to an Azure Function App (blabla-pub-api-dev) via Serverless API hosting. Both use custom domains; SWA uses https://dev.blabla.bla and the Function App uses https://api.dev.blabla.bla

The app uses an SSR-like architecture where pages are rendered by the Function App and returned through SWA routes (e.g., /api/pages/...).

The Function App issues short-lived session cookies like this:

Set-Cookie: auth_secret=abc123; Path=/; HttpOnly; Secure; SameSite=None

When I call the endpoint directly (https://api.dev.blabla.bla/api/debug/probe), the cookie appears in the browser as expected. However, when I call the same endpoint through SWA proxy (https://dev.blabla.bla/api/debug/probe), the response arrives without any Set-Cookie header — it’s stripped by SWA before reaching the browser.

No redirect or CORS issue occurs, and the Function logs clearly show the cookie being set.

Using python Azure Functions.

I expected the Set-Cookie header to pass through the SWA proxy unchanged since both apps share the same top-level domain (dev.blabla.bla) and SWA should act as a transparent proxy for the linked backend.

I verified the following:

• Function App returns a 200 OK response (not 3xx).

• Cookie attributes are valid (Secure; HttpOnly; SameSite=None).

• CORS allows origin https://dev.blabla.bla with credentials.

• The issue persists with and without the Domain attribute.

• Works perfectly when called directly (outside SWA).

It seems Azure Static Web Apps are filtering or not forwarding Set-Cookie headers for linked Function backends.

staticwebapp.config.json

{
    "routes": [
    { 
        "route": "/", 
        "rewrite": "/api/pages/index" 
    },
    { 
        "route": "/en/auth/registration", 
        "rewrite": "/api/pages/auth/registration" 
    },
    { 
        "route": "/en/settings", 
        "rewrite": "/api/pages/settings"
    },     
    { 
        "route": "/api/*", 
        "allowedRoles": ["anonymous"] 
    }
    ],
    "navigationFallback": {
        "rewrite": "/index.html",
        "exclude": ["/api/*", "/styles/*", "/scripts/*", "/public/*", "/auth/*"]   
    }
}

Has anyone successfully made cookies propagate through a linked Function App? Do I need an additional configuration (headers, rewrite rules, or API Management gateway) to make SWA pass the cookie header intact?