Once you start writing the HTTP response body, you cannot add an HTTP
response header.
This is easily understood when you realize the HTTP is streamed to the
client. Simply put, when the data is sent, it's too late to recall it.
So, you need to re-organize your logic to add the Cookie before writing the
body.
In all cases, at the end, the order will have to be correct, as you cannot
add another HTTP header after you started writing the HTTP body.
It depends on what you are doing in the filter ...