title: Why cookie not being set in browser, but it does in POSTMAN?
body: <p>I am sending a GET request for Basic authentication, to which the server(the backend API) would return(if the authentication is successful) a cookie. This is working fine for POSTMAN, but in browser cookie is not being set.   </p>
  
  <pre><code>@GetMapping("/login")
  @ResponseStatus(value=HttpStatus.OK)
  public void loginUser( final HttpServletRequest request ,final HttpServletResponse response) throws UnsupportedEncodingException {
  
          setAuthCookieToResonse(request,response);    
      }
  
  private void setAuthCookieToResonse(final HttpServletRequest request ,final HttpServletResponse response) throws UnsupportedEncodingException {
      logger.debug("Adding cookie after authentication");
      String cookieKey = "auth";
      String cookieValue = request.getHeader("Authorization");
  
      if (cookieValue != null) {
          Cookie cookie = new Cookie(cookieKey, URLEncoder.encode(cookieValue, "utf-8"));
          cookie.setHttpOnly(true);
          cookie.setDomain("localhost");
  
          response.addCookie(cookie);
      }
  }
  </code></pre>
  
  <p>Here is my application flow:</p>
  
  <ol>
  <li>Browser/POSTMAN login using basic authentication. Send credentials
  using <code>Authorization Basic xxxxxx==</code> header.</li>
  <li>Server reads the authentication details, and if correct it creates a
  cookie named <code>auth</code> and send it back with the response(above code).
  For security layer, I am using Spring security.</li>
  <li>For further requests, that cookie will automatically be sent with
  each request. Now I had to take that cookie and extract the
  authentication details from that. After that, I had to add
  <code>Authorization Basic xxxxxx==</code> to that request(Because now the
  <code>Authorization</code> not sent by the client, only cookie sent). For this
  I created the <code>Filter</code> which will run before Spring's
  <code>BasicAuthenticationFilter.class</code></li>
  </ol>
  
  <p>The step 2 is working for POSTMAN, but not for the browser. In POSTMAN, the server sent <code>response</code> contains <code>Set-Cookie →auth=Basic xxxxxxxx=; Domain=localhost; HttpOnly</code>.</p>
  
  <pre><code>curl -i -u pu@gmail.com:password@ http://localhost:8085/api/v1/login
  
  HTTP/1.1 200
  Set-Cookie: auth=Basic xxxxxxxx==; HttpOnly
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Frame-Options: DENY
  Content-Length: 0
  Date: Tue, 12 Feb 2019 05:59:33 GMT
  </code></pre>
  
  <p>The response header in browser:</p>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Origin: http://localhost:3007
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Content-Length: 0
  Date: Tue, 12 Feb 2019 11:52:10 GMT
  Expires: 0
  Pragma: no-cache
  Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  </code></pre>
  
  <p>What additional configuration do I need to do here?</p>