无法设置Cookie求助：后端登录设置Cookie前端未显示

后端处理登录请求时生成refreshToken并通过ResponseCookie写入响应，但前端浏览器的Applications/Cookies中看不到该Cookie。以下是相关代码和配置：

1. Cookie设置代码 #

ResponseCookie cookie = ResponseCookie.from("refreshToken", refreshToken)
                .httpOnly(true)
                .secure(false)
                .path("/")
                .maxAge(7 * 24 * 60 * 60)
                .sameSite("Strict")
                .build();

        response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());

2. CorsFilter配置代码 #

@Bean
    public CorsFilter corsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.addAllowedOrigin("http://localhost:3030");
        config.addAllowedHeader("*");
        config.addAllowedMethod("*");
        config.setAllowCredentials(true);
        source.registerCorsConfiguration("/**", config);
        return new CorsFilter(source);
    }

3. 登录接口Controller代码 #

@Operation(summary = "Đăng nhập", description = "API để đăng nhập")
    @PostMapping("/login")
    public ApiResponse<LoginRespone> login(
            @Valid
            @RequestBody LoginRequest request,
            HttpServletResponse response
    ){
        return ApiResponse.<LoginRespone>builder()
                .result(authService.login(request, response))
                .build();
    }

4. 登录Service核心代码 #

public LoginRespone login(LoginRequest request, HttpServletResponse response){

        User user = userRepository.findByEmail(request.getEmail())
                .orElseThrow(() -> new AppException(ErrorCode.NOT_EXISTED));

        if (user.getIsActive() == Status.PENDING){
            userRepository.log_auth("login", user.getUserId(), user.getEmail(), "Fail", "Unverified account");
            throw new AppException(ErrorCode.UNVERIFIED_ACCOUNT);
        }

        if (user.getIsActive() == Status.BANNED){
            userRepository.log_auth("login", user.getUserId(), user.getEmail(), "Fail", "Forbidden account");
            throw new AppException(ErrorCode.FORBIDDEN_ACCOUNT);
        }

        boolean authenticated = passwordEncoder.matches(
                request.getPassword(),
                user.getPassword()
        );

        if (!authenticated) {
            userRepository.log_auth("login", user.getUserId(), user.getEmail(), "Fail", "Wrong password");
            throw new AppException(ErrorCode.UNAUTHENTICATED);
        }

        var accessToken = jwtService.generateAccessToken(user);
        var refreshToken = jwtService.generateRefreshToken(user);

        var storedToken = Token.builder()
                .token(refreshToken)
                .tokenType(TokenType.BEARER)
                .userId(user.getUserId())
                .build();
        tokenRepository.save(storedToken);

        ResponseCookie cookie = ResponseCookie.from("refreshToken", refreshToken)
                .httpOnly(true)
                .secure(false)
                .path("/")
                .maxAge(7 * 24 * 60 * 60)
                .sameSite("Lax")
                .build();

        response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());

        userRepository.log_auth("login", user.getUserId(), user.getEmail(), "Success", "Login successfully");

        return LoginRespone.builder()
                .accessToken(accessToken)
                .refreshToken(refreshToken)
                .userResponse(userMapper.toUserResponse(user))
                .build();
    }

同时附上前端请求截图、CorsFilter配置截图，恳请帮忙排查该Cookie无法在前端显示的问题。

内容的提问来源于stack exchange，提问作者TunazZz