title: Spring security + session : Receive "Set-Cookie" header but not set in browser
body: <p>I'm trying Spring Security &amp; Session with an Angular front end.
  I get a 200 code when trying to login with that response header : </p>
  
  <pre><code>Set-Cookie: SESSION=NGJlYTkzODQtNTQzMy00NGIxLWEzOWYtYTc2MGNlZWY1OTJm; Path=/; HttpOnly; SameSite=Lax
  </code></pre>
  
  <p>But in my next request to the server, no cookie is automatically set in the request. And by the way, I cannot see the cookie in the developer tools so I think it's not saved.</p>
  
  <p>I'm working in local for the front &amp; back end. </p>
  
  <p>Here are some info about the back end :</p>
  
  <ul>
  <li><p>using Spring MongoDb Session
  <code>
  @Configuration
  @EnableMongoHttpSession
  public class SessionConfig {
  }
  </code></p>
  
  <ul>
  <li>Classic Spring security Config</li>
  </ul></li>
  </ul>
  
  <p>`
      @EnableWebSecurity
      public class SecurityConfig extends WebSecurityConfigurerAdapter {
      private final CustomAuthenticationProvider authProvider;</p>
  
  <pre><code>public SecurityConfig(CustomAuthenticationProvider authProvider) {
      this.authProvider = authProvider;
  }
  
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(authProvider);
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          .cors().and()
          .authorizeRequests()
          .anyRequest().authenticated()
          .and()
          .httpBasic(); //todo csrf
  }
  
  @Bean
  CorsConfigurationSource corsConfigurationSource() {
      CorsConfiguration configuration = new CorsConfiguration();
      configuration.setAllowedOrigins(Collections.singletonList("http://localhost:4200")); // todo properties by environment
      configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "DELETE", "PUT", "PATCH"));
      configuration.setAllowedHeaders(Arrays.asList("X-Requested-With", "Origin", "Content-Type", "Accept", "Authorization"));
      configuration.setAllowCredentials(true);
      UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
      source.registerCorsConfiguration("/**", configuration);
      return source;
  }
  </code></pre>
  
  <p>}
  `</p>
  
  <p>The session is well saved in the mongodb, just the id not saved in the browser.
  Any idea ?</p>
  
  <p><strong>edit</strong> </p>
  
  <p>When setting <code>observer: "response"</code> in the httpClient parameters, I cannot see the Set-Cookie header :</p>
  
  <p><code>"cache-control: no-cache, no-store, max-age=0, must-revalidate,content-type: application/json,expires: 0,pragma: no-cache"</code></p>
  
  <p>But in the developer tool I have :</p>
  
  <p><code>
  HTTP/1.1 200 
  Vary: Origin
  Vary: Access-Control-Request-Method
  Vary: Access-Control-Request-Headers
  Access-Control-Allow-Origin: http://localhost:4200
  Access-Control-Allow-Credentials: true
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Frame-Options: DENY
  Set-Cookie: SESSION=YTEwOTNkNjAtZjI4MS00ZmM2LWExYmEtYzA5NzJhMjAyNTJh; Path=/; HttpOnly; SameSite=Lax
  Content-Type: application/json
  Transfer-Encoding: chunked
  Date: Mon, 01 Jul 2019 11:25:08 GMT
  </code></p>