Не получается авторизоваться c Jwt

Не пойму в чем дело в постмане токен получаю, и все работает, через браузер нет

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter implements WebMvcConfigurer {

    private final SecurityHelper securityHelper;
    private final AuthEntrypointJwt unauthenticatedHandler;
    private final AuthTokenFilter authTokenFilter;

    @Autowired
    public SecurityConfig(SecurityHelper securityHelper, AuthEntrypointJwt unauthenticatedHandler, AuthTokenFilter authTokenFilter) {
        this.securityHelper = securityHelper;
        this.unauthenticatedHandler = unauthenticatedHandler;
        this.authTokenFilter = authTokenFilter;
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        CharacterEncodingFilter filter = new CharacterEncodingFilter();
        filter.setEncoding("UTF-8");
        filter.setForceEncoding(true);
        http.cors();
        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/api/auth/**","/login","/","/error","/static/**").permitAll()
                .and().authorizeRequests().anyRequest().authenticated()
                .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.addFilterBefore(authTokenFilter, UsernamePasswordAuthenticationFilter.class);
        http.exceptionHandling().authenticationEntryPoint(unauthenticatedHandler);
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(securityHelper);
    }

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedOrigins("*")
                .allowedMethods("*");
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder getPasswordEncoder() {
        return  new BCryptPasswordEncoder();
    }
}

Фильтр

@Component
public class AuthTokenFilter extends OncePerRequestFilter {


    @Autowired
    private JwtUtils jwtUtils;

    @Autowired
    private SecurityHelper securityHelper;

    @SneakyThrows
    @Override
    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain)  {
        String jwt = parseJwt(httpServletRequest);

        if (jwt != null && jwtUtils.validateJwtToken(jwt)) {
            String username = jwtUtils.getUsernameFromToken(jwt);

            UserDetails userDetails = securityHelper.loadUserByUsername(username);
            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(authenticationToken);
        }

        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private String parseJwt(HttpServletRequest request) {
        String headerAuth = request.getHeader("Authorization");

        if (StringUtils.hasText(headerAuth) && headerAuth.startsWith("Bearer_")) {
            return headerAuth.substring(7);
        }

        return null;
    }
}

Login

const formLogin = document.getElementById('login-page')
const errorLogin = document.getElementById('login-error')
const btn = document.getElementById('show-password')
let email = document.getElementById('email')
let password = document.getElementById('password')
let token = ''


formLogin.addEventListener('submit', (event) => {

    event.preventDefault()
    const data = {
        username: email.value.toString(),
        password: password.value.toString()
    }

    fetch('http://localhost:5557/api/auth/token', {
        method: 'post',
        body: JSON.stringify(data),
        headers: {
            'Content-Type': 'application/json;charset=utf-8',
        }
    }).then(promise => {
            if (promise.status >= 200 && promise.status < 300) {
                return promise.json()
            } else {
                errorLogin.innerHTML = ''
                errorLogin.innerHTML = '<div class="alert alert-danger" role="alert">' +
                    'Введён неверный логин или пароль!</div>'
            }
        }
    ).then(response => {
        if (response !== null && response !== {}) {
            token = response.jwtType + '_' + response.jwtToken
            document.cookie = 'token=' + token + ';'
            window.location.href = '/site'
        } else {
            errorLogin.innerHTML = ''
            errorLogin.innerHTML = '<div class="alert alert-danger" role="alert">' +
                'Доступ к системе запрещён!</div>'
        }
    });
})

function showPassword() {
    if (password.type === "password") {
        password.type = "text";
        btn.innerHTML = ''
        btn.innerHTML = '&#x2606;'
    } else {
        password.type = "password";
        btn.innerHTML = ''
        btn.innerHTML = '&#x2605;'
    }
}