title: Cannot get cookies in Java Spring Boot / Angular application
body: <p>I am working on a Angular11 frontend app coupled with a Java Spring boot backend.</p>
  <h3>Context</h3>
  <p>I am trying to create an authentication with cookies with JWT.
  To do so I am inspired by</p>
  <ul>
  <li><a href="https://stackoverflow.com/questions/27726066/jwt-refresh-token-flow">JWT refresh token flow</a></li>
  <li><a href="https://stackoverflow.com/questions/62999140/access-token-and-refresh-token-best-practices-how-to-implement-access-refres">Access token and Refresh token best practices ? How to implement Access &amp; Refresh Tokens</a></li>
  </ul>
  <p>My endpoint <code>/authenticate</code> returns a jwt access token and set a jwt refresh token in the cookies (httpOnly).<br />
  My endpoint <code>/refreshtoken</code> gets the refresh token from the cookies and validates it before generating a new jwt access token and a new jwt refresh token.<br />
  Here is the code of my <code>AuthenticationController</code></p>
  <pre class="lang-java prettyprint-override"><code>    @RestController
      @AllArgsConstructor
      @CrossOrigin(origins = &quot;http://localhost:4200&quot;, allowCredentials = &quot;true&quot;)
      public class AuthenticationController {
          
              private final AuthenticationManager authenticationManager;
              private final JwtTokenUtil jwtTokenUtil;
              private final UserDetailsServiceImpl userDetailsService;
              private final static String REFRESH_TOKEN_COOKIE = &quot;resfreshtoken&quot;;
          
              @PostMapping(value = &quot;/authenticate&quot;)
              public ResponseEntity&lt;JwtAuthenticationResponse&gt; createAuthenticationToken(@RequestBody JwtAuthenticationRequest authenticationRequest, HttpServletResponse response) throws Exception {
                  try {
                      this.authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(authenticationRequest.getUsername(), authenticationRequest.getPassword()));
                  }
                  catch (DisabledException e) {
                      throw new Exception(&quot;USER_DISABLED&quot;, e);
                  }
                  catch (BadCredentialsException e) {
                      throw new Exception(&quot;INVALID_CREDENTIALS&quot;, e);
                  }
                  final UserDetails userDetails = this.userDetailsService.loadUserByUsername(authenticationRequest.getUsername());
                  final String token = this.jwtTokenUtil.generateToken(userDetails.getUsername());
                  final String refreshToken = this.jwtTokenUtil.generateRefreshToken(new HashMap&lt;&gt;(), userDetails.getUsername());
          
                  Cookie cookie = new Cookie(REFRESH_TOKEN_COOKIE, refreshToken);
                  cookie.setHttpOnly(true);
                  // cookie.setDomain(&quot;localhost&quot;);
                  // cookie.setPath(&quot;/&quot;);
                  response.addCookie(cookie);
          
                  return ResponseEntity.ok(new JwtAuthenticationResponse(token));
              }
          
              @GetMapping(value = &quot;/refreshtoken&quot;)
              public ResponseEntity&lt;?&gt; refreshToken(@CookieValue(value = REFRESH_TOKEN_COOKIE, required = false) String refreshToken, HttpServletRequest request, HttpServletResponse response) {
                  Cookie[] cookies = request.getCookies(); // ALWAYS returns null
                  log.debug(&quot;refreshToken {}&quot;, refreshToken); // ALWAYS null
                  try {
                      Claims claims = this.jwtTokenUtil.getAllClaimsFromToken(refreshToken);
                      final String username = claims.get(&quot;sub&quot;).toString();
                      final String newAccessToken = this.jwtTokenUtil.generateToken(username);
                      final String newRefreshToken = this.jwtTokenUtil.generateRefreshToken(claims, username);
                      CookieUtil.writeCookie(response, REFRESH_TOKEN_COOKIE, newRefreshToken);
          
                      return ResponseEntity.ok(new JwtAuthenticationResponse(newAccessToken));
                  }
                  catch (SignatureException | MalformedJwtException | UnsupportedJwtException | IllegalArgumentException ex) {
                      throw new BadCredentialsException(&quot;INVALID_CREDENTIALS&quot;, ex);
                  }
                  catch (ExpiredJwtException e) {
                      // user should re-login
                  }
      
                    return new ResponseEntity&lt;&gt;(&quot;Something went wrong&quot;, HttpStatus.BAD_REQUEST);
                  }
          }
  </code></pre>
  <p>On Angular frontend, here are the options I add to my /refreshtoken Http request (<code>withCredentials=true</code>)</p>
  <pre><code>refreshToken(): Observable&lt;AuthenticationResponse&gt; {
          return this.http.get&lt;AuthenticationResponse&gt;(this.apiUrl + 'refreshtoken', { withCredentials: true }).pipe(
              tap(response =&gt; LocalStorageUtils.save(LocalStorageKey.JWT_ACCESS_TOKEN_KEY, response.jwtAccessToken))
          );
      }
  </code></pre>
  <h3>My issue</h3>
  <p>If I try to reach my endpoint <code>/authenticate</code> then <code>/refreshtoken</code> from postman, everything works well and I can see the cookie<br />
  If I call <code>/authenticate</code> from my frontend, I can see the cookie in the response with the header SET-COOKIE (and in the <em>cookies</em> tab)
  <a href="https://i.stack.imgur.com/HKYiH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HKYiH.png" alt="enter image description here" /></a>
  But then if I call <code>/refreshtoken</code> from my frontend, I cannot get the cookies with <code>request.getCookies()</code> nor <code>@CookieValue()</code> on the backend, <strong>it always returns null</strong> !<br />
  <strong>It seems like the cookie is well received on the frontend but not set anywere (I cannot see it in <em>application</em> tab -&gt; cookies on Chrome).<br />
  Therefore it is not sent with the /refreshtoken request</strong></p>
  <p>If anyone can help or has an idea about what is going wrong, I would be grateful ! I can provide more details about my code if it is needed.</p>