Angular Springboot JWT Refresh Token Cookie not set on browser

I'm implementing an authentication flow with:

Angular frontend running on http://localhost:4200

Spring Boot backend running on http://localhost:8080

After a successful login, the backend sends a Set-Cookie header with an HttpOnly refresh token. The header is present in the response, but the browser does not store the cookie. It's not visible under DevTools → Application → Storage → Cookies, and it is not sent with subsequent requests.

Backend: Spring Boot Cookie Code java

private TokenResponse generateTokenResponse(String usernameOrEmail, HttpServletResponse response) {
    UserEntity user = userService.findByUserNameOrEmail(usernameOrEmail);
    Set<String> roles = userService.getUserRoles(user);
    String token = jwtTokenProvider.generateToken(user.getUserName(), roles);
    String refreshToken = jwtTokenProvider.generateRefreshToken(user.getUserName());

    // Set HttpOnly refresh token cookie
    String cookieValue = "refresh_token=" + refreshToken +
        "; HttpOnly; Path=/auth/refresh; Max-Age=" + (7 * 24 * 60 * 60) +
        "; SameSite=Lax";

    response.addHeader("Set-Cookie", cookieValue);
    return new TokenResponse(token, jwtTokenProvider.getJwtExpirationInMs() / 1000, roles);
}

Backend: CORS Config java

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowCredentials(true);
    configuration.setAllowedOrigins(List.of("http://localhost:4200"));
    configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
    configuration.setAllowedHeaders(List.of("*"));

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

Frontend: Angular HTTP Call I'm using Angular’s HttpClient and setting withCredentials: true:

typescript

this.http.post('/auth/refresh', body, {
  withCredentials: true
}).subscribe();

why dont I see the cookie under Applications? its not passed on subsequent request for /auth/refresh endpoint