Why isn't the Set-Cookie header coming?

Question

JavaScript

There are two applications: client and server. Both lie on different domains (in my case - on different ports).
The client (JavaScript application), using axios, makes the following request:

axios.get(API.getUserData(), {withCredentials: true}).then(response => {
    if (response.status === 200) {
        console.log('Получены данные пользователя: ' + response.data);
    }
}).catch(exception => {
    console.log('Ошибка доступа к серверу');
    console.log('Детали ошибки: ' + exception.toString());
});

The request goes to another domain, I remind you.
The server (Tomcat, java application) makes the response like this:

//начало метода
response.addHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "http://localhost:2323"); //Адрес клиента
response.addHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
response.addHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET");
response.addHeader(HttpHeaders.SET_COOKIE, "token=" + getStringToken());
response.setStatus(200);
//установка тела ответа и возврат результата

As a result, the cross-domain request passes, the client receives all the necessary information in the response body and all headers, except for Set-Cookie. What could be the problem?

Answer 1

Access-Control-Allow-Headers: ...Set-Cookie...
Where do you have it?

Answer 2

It comes, but it cannot be accessed from JS, because the Set-Cookie header is on the blocked list.
https://developer.mozilla.org/en-US/docs/Web/API/H...
https://developer.mozilla.org/en-US/docs/Glossary/...