CORS Error - Spring Boot Security + HTTPs Redirect

Question

I can't make HTTPs work correctly with CORS in Spring Boot Security. I've searched and tried different solutions around the web and StackOverFlow, but I've reached a point where I don't know what to do.

I keep getting this error from an Angular FrontEnd app (Firefox): Request from another blocked source: the same source policy prevents reading the remote resource at http://172.20.3.9:8080/api/auth/signin (reason: the CORS header 'Access-Control-Allow-Origin' is missing). [Know more] Cross-origin blocked request: The same origin policy does not allow the reading of remote resources at http://172.20.3.9:8080/api/auth/signin. (Reason: CORS request without success).

I have a Bean definition to implement HTTPs redirection within my Tomcat like this:

@Bean
public TomcatServletWebServerFactory servletContainer(){
TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {
@Override
protected void postProcessContext(Context context) {
SecurityConstraint securityConstraint = new SecurityConstraint();
securityConstraint.setUserConstraint("CONFIDENTIAL");
SecurityCollection collection = new SecurityCollection();
collection.addPattern("/*");
securityConstraint.addCollection(collection);
context.addConstraint(securityConstraint);
}
};
tomcat.addAdditionalTomcatConnectors(redirectConnector());
return tomcat;
}

private Connector redirectConnector(){
Connector connector = new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
connector.setScheme("http");
connector.setPort(8080);
connector.setSecure(false);
connector.setRedirectPort(8444);
return connector;
}

Also I have a WebSecurity class extending WebSecurityConfigurerAdapter with my CORS Filter and overriding configurate

@Bean
public CorsFilter corsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOrigin("*");
config.addAllowedHeader("*");
config.addAllowedMethod("OPTIONS");
config.addAllowedMethod("GET");
config.addAllowedMethod("POST");
config.addAllowedMethod("PUT");
config.addAllowedMethod("DELETE");
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);

This method is simplified right now. I've test a lot of configurations: with/without .cors(), channelSecure and so on.

protected void configure(HttpSecurity http) throws Exception {

http.cors().and().authorizeRequests().antMatchers("/api/auth/**")
.permitAll()

http.addFilterBefore(corsFilter(), ChannelProcessingFilter.class);
http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);

I have also tried to define @CrossOrigin in the controller/method. My current configure method without HTTPs redirection Works fine, no CORS problem:

protected void configure(HttpSecurity http) throws Exception {
            http
            .csrf().disable()
            .exceptionHandling()
            .authenticationEntryPoint(unauthorizedHandler)
            .and()
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .authorizeRequests()
            .antMatchers("/api/auth/**")
            .permitAll()
            .anyRequest().anonymous();

            http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
}

So I guess the problem is the combination of Spring Security and the HTTPS Redirect in Tomcat. Could anybody help me to solve this problem? Thanks in advance,

3 years later, but I've got almost the same problem. Spring boot, HTTPS, redirect, CORS, and Angular, and the same error. Did you find out what the issue was? — redOctober13

Alexander Petrov Alexander Petrov · Accepted Answer · 2018-09-26T15:38:35

All you need to do is create the following class

@Configuration
public class WebConfiguration extends WebMvcConfigurerAdapter {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedOrigins("*")
                .allowedMethods("*");
    }
}

CORS Error - Spring Boot Security + HTTPs Redirect

1 Answers