Angular Springboot JWT Refresh Token Cookie not set on browser

I'm implementing an authentication flow with:

Angular frontend running on http://localhost:4200

Spring Boot backend running on http://localhost:8080

After a successful login, the backend sends a Set-Cookie header with an HttpOnly refresh token. The header is present in the response, but the browser does not store the cookie. It's not visible under DevTools → Application → Storage → Cookies, and it is not sent with subsequent requests.

Backend: Spring Boot Cookie Code java

private TokenResponse generateTokenResponse(String usernameOrEmail, HttpServletResponse response) {
UserEntity user = userService.findByUserNameOrEmail(usernameOrEmail);
Set<String> roles = userService.getUserRoles(user);
String token = jwtTokenProvider.generateToken(user.getUserName(), roles);
String refreshToken = jwtTokenProvider.generateRefreshToken(user.getUserName());

// Set HttpOnly refresh token cookie
String cookieValue = "refresh_token=" + refreshToken +
"; HttpOnly; Path=/auth/refresh; Max-Age=" + (7 * 24 * 60 * 60) +
"; SameSite=Lax";

response.addHeader("Set-Cookie", cookieValue);
return new TokenResponse(token, jwtTokenProvider.getJwtExpirationInMs() / 1000, roles);
}


Backend: CORS Config java

@Bean
public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowCredentials(true);
configuration.setAllowedOrigins(List.of("http://localhost:4200"));
configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
configuration.setAllowedHeaders(List.of("*"));

UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}


Frontend: Angular HTTP Call I'm using Angular’s HttpClient and setting withCredentials: true:

typescript

this.http.post('/auth/refresh', body, {
withCredentials: true
}).subscribe();


why dont I see the cookie under Applications? its not passed on subsequent request for /auth/refresh endpoint

Continue reading...