Allow cookie on unsecure domain

I have my project running on https://localhost:5001 and I want to access it from a site running on http://localhost:3000. The site on http://localhost:3000 can make a successful authenticate request but the auth cookie does not get set in JsonServiceClient. Running on https the cookie gets set correctly. These are the headers:

General
Request URL: https://localhost:5001/json/reply/Authenticate
Request Method: POST
Status Code: 200 
Remote Address: [::1]:5001
Referrer Policy: strict-origin-when-cross-origin

Response
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Allow, Authorization, X-Args
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD
access-control-allow-origin: http://localhost:3000
content-type: application/json; charset=utf-8
date: Wed, 10 Nov 2021 04:03:44 GMT
server: Kestrel
set-cookie: ss-id=yjHzB7bEOgfKvSOy1hEL; path=/; secure; samesite=lax; httponly
set-cookie: ss-pid=8bGyiksCKX2TFcpvHOnE; expires=Sun, 10 Nov 2041 04:03:44 GMT; path=/; secure; samesite=lax; httponly
set-cookie: ss-opt=temp; expires=Sun, 10 Nov 2041 04:03:44 GMT; path=/; secure; samesite=lax; httponly
set-cookie: X-UAId=1; expires=Sun, 10 Nov 2041 04:03:44 GMT; path=/; secure; samesite=lax; httponly
vary: Accept
x-powered-by: ServiceStack/5.120 NetCore/Windows

request
:authority: localhost:5001
:method: POST
:path: /json/reply/Authenticate
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: en,en-GB;q=0.9
cache-control: no-cache
content-length: 52
content-type: application/json
origin: http://localhost:3000
pragma: no-cache
referer: http://localhost:3000/
sec-ch-ua: "Google Chrome";v="95", "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36

I am trying to find the right setting to allow the cookie on non-secure domain. Sessions have been added to the project by the Auth plugin. I tried:

SetConfig(new HostConfig
{
    AddRedirectParamsToQueryString = true,
    DebugMode = AppSettings.Get(nameof(HostConfig.DebugMode), HostingEnvironment.IsDevelopment()),
    UseHttpOnlyCookies = false,
    UseSecureCookies = false,
});

But it is still not saving the cookie for subsequent requests. What do I need to set to allow the cookie on http? edit: Cors:

appHost.Plugins.Add(new CorsFeature(
                allowOriginWhitelist: new[]
                { 
                    "https://localhost:5001",
                    "http://localhost:3000",
                    "https://localhost:3000"
                },
                allowCredentials: true,
                allowedHeaders: "Content-Type, Allow, Authorization, X-Args"));
        }

I am creating typescript client like so:

let client = new JsonServiceClient(environment.apiUrl);
    let req = new Authenticate();
    req.userName = email;
    req.password = password;
    req.rememberMe =rememberMe;

    let resp = await client.post(req);

Failed subsequent request:

equest URL: https://localhost:5001/json/reply/NextInputRequest
Request Method: GET
Status Code: 401 
Remote Address: [::1]:5001
Referrer Policy: strict-origin-when-cross-origin
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Allow, Authorization, X-Args
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD
access-control-allow-origin: http://localhost:3000
content-length: 0
date: Wed, 10 Nov 2021 06:23:58 GMT
server: Kestrel
set-cookie: ss-pid=bS8yNkiGoDuJpkTicMry; expires=Sun, 10 Nov 2041 06:23:59 GMT; path=/; secure; samesite=lax; httponly
set-cookie: ss-id=1c38cciEgpnwTEg5DDaf; path=/; secure; samesite=lax; httponly
vary: Accept
www-authenticate: credentials realm="/auth/credentials"
x-powered-by: ServiceStack/5.120 NetCore/Windows
:authority: localhost:5001
:method: GET
:path: /json/reply/NextInputRequest
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: en
cache-control: no-cache
content-type: application/json
origin: http://localhost:3000
pragma: no-cache
referer: http://localhost:3000/
sec-ch-ua: "Google Chrome";v="95", "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36