Ndtyjky

I added in Security into my Spring app and suddenly I am getting CORS issues. I have tried many different CORS settings in Spring (see some of the commented out code). Nothing is working.

I am passing basic auth in my front end Angular app as so:

const httpOptions = {

headers: new HttpHeaders({

  'Content-Type': 'application/json',

  'Authorization': 'Basic mybase64basicauth'

  })

};



...

this.campaignsSubscription = this.http.get<Campaign>(this.campaignsUrl, httpOptions)

And I have my app configured for CrossOrigin both locally and globally.

Global:

@Configuration

@EnableWebFlux

public class WebConfig implements WebFluxConfigurer {



   @Override

   public void addCorsMappings(CorsRegistry registry) {



    registry.addMapping("/**")

            .allowedOrigins("http://localhost:4200")

            .allowedMethods("PUT", "DELETE", "GET", "OPTIONS", "POST", "PATCH")

            .allowedHeaders("Authorization", "Content-Type")

            // .allowedHeaders("Content-Type")

            .allowCredentials(true).maxAge(3600);



    // Add more mappings...

   }

}

And locally:

/*@CrossOrigin(origins = "http://localhost:4200",

    allowedHeaders = "*",

    methods = { RequestMethod.DELETE, RequestMethod.GET, RequestMethod.HEAD, RequestMethod.OPTIONS, RequestMethod.PATCH, RequestMethod.PUT},

    allowCredentials = "true"

    )*/

@CrossOrigin

@RestController

@RequestMapping("/api/campaign")

public class CampaignResource {



private CampaignRepository campaignRepository;



public CampaignResource(CampaignRepository campaignRepository) {

    this.campaignRepository = campaignRepository;

}





@GetMapping("/all")

public Flux<Campaign> getAll() {

    return campaignRepository

            .findAll();



 ...

But I get these errors in the Chrome console:

        zone.js:2969 OPTIONS http://localhost:8081/api/campaign/all 401 (Unauthorized)



   'http://localhost:8081/api/campaign/all' from origin 

   'http://localhost:4200' has been blocked by CORS policy: Response to 

   preflight request doesn't pass access control check: No 'Access- 

    Control-Allow-Origin' header is present on the requested resource.

I know the basic auth is correct as it works in Postman.

When using Spring Security 5.x...

The answer is two fold:

1) In your SecurityWebFilterChain you must add:

.pathMatchers(HttpMethod.OPTIONS, "/**").permitAll()**strong text**

2) In your Resource you must add the following CORS statement:

@CrossOrigin(origins = "http://localhost:4200",

        allowedHeaders = "*",

        methods = { RequestMethod.DELETE, RequestMethod.GET, RequestMethod.HEAD, RequestMethod.OPTIONS, RequestMethod.PATCH, RequestMethod.PUT},

        allowCredentials = "true"

        )

Here is my complete SecurityConfig class:

@Configuration

@EnableWebFluxSecurity

@EnableReactiveMethodSecurity

public class SecurityConfig {



    @Bean

    SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) {

        return http

                .authorizeExchange()

                .pathMatchers(HttpMethod.OPTIONS, "/**").permitAll()

                .pathMatchers("/login", "/logout").permitAll()

                .pathMatchers("/i18n/**",

                        "/css/**",

                        "/fonts/**",

                        "/icons-reference/**",

                        "/img/**",

                        "/js/**",

                        "/vendor/**").permitAll()

                .pathMatchers(HttpMethod.GET,"/api/**").authenticated()

                .anyExchange()

                .authenticated()

                .and()

               .formLogin()

                .and()

                .httpBasic()

                /*.loginPage("/login")

                .and()

                .logout()

                .logoutUrl("/logout")*/

                .and()

                .csrf().disable()

                .build();

    }





    //in case you want to encrypt password

    @Bean

    public BCryptPasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

}