apach nifi 1.16.3 no return __Secure-Request-Token cookie when calling restapi 'access/token'

i have a single instance of apache nifi 1.16.3 with self-sign certification. when using postman to test call the rest api https://localhost:8443/nifi-api/access/token, it only returns 1 cookie: __Secure-Authorization-Bearer. However, when checking the "network" info in chrome after the login UI, it shows 2 cookies: __Secure-Authorization-Bearer and __Secure-Request-Token.

• postman

ref code:

curl --location --request POST'https://localhost:8443/nifi-api/access/token'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'username=nifiuser'
--data-urlencode 'password=nifipassword'

• chrome

May I know how to get the __Secure-Request-Token cookie thru apache nifi restapi?

PS, in apache nifi 1.27, the api https://localhost:8443/nifi-api/access/token returns the expected 2 cookies