Laravel 5.4 is not setting cookies when uploaded to server

I am facing this issue since last 2 days, tried many things but not able to get it working, I am getting most annoying tokenMismatchExceptionexception.

I tried a fresh installation that works fine, so I copied vendor folder from working on to my actual app, but it didn't work. After more digging, I saw that laravel_session & XSRF-TOKEN cookies are not set in chrome dev tool.

What could be the reason, same app is working on localhost but not working on the server.

Main problem what I see it not able to set the cookies (laravel_session & XSRF-TOKEN)

Session storage is working as I can see on server storage/framework/session/ creates new file on refresh. So it's not permission error.

Alos tried by changing APP_URL & SESSION_DOMAIN, no luck.

Laravel Framework 5.4.16

Kernel Middleware

'web' => [
            \Illuminate\Session\Middleware\StartSession::class,
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            \App\Http\Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
            \Laravel\Passport\Http\Middleware\CreateFreshApiToken::class,
        ],

.env

    APP_ENV=local
    APP_KEY=base64:7WcmnZI8WcYQiNr9jn3JcTf//1scVAPtz2crL0bz4TE=
    APP_DEBUG=true
    APP_LOG_LEVEL=debug
    APP_URL=http://localhost
    
    DB_CONNECTION=sqlite
    
    BROADCAST_DRIVER=log
    CACHE_DRIVER=file
    SESSION_DRIVER=file
    QUEUE_DRIVER=sync

app/session.php

    return [
        'driver' => env('SESSION_DRIVER', 'file'),
        'lifetime' => 120,
        'expire_on_close' => false,
        'encrypt' => false,
        'files' => storage_path('framework/sessions'),
        'connection' => null,
        'table' => 'sessions',
        'store' => null,
        'lottery' => [2, 100],
        'cookie' => 'laravel_session',
        'path' => '/',
        'domain' => env('SESSION_DOMAIN', null),
        'secure' => env('SESSION_SECURE_COOKIE', false),
        'http_only' => true,
    ];

Same settings work on fresh install. please help guys