I have Auth setup via an external api. I have been reading online and the use of http-only cookies is more favourable over local storage to minimise XSS.

If i use client side api calls the http-only cookie is attached. if i use server side rendering of the api calls the cookie isnt attached. How do i achieve this?