spring CORS and angular not working : HTTP status code 403 error

Question

I am new to angular and spring-security.I am having problem with CORS when trying to log in from angular login-form page using basic authentication to the rest endpoint. My Angular code is running on http://localhost:4200 and rest end point on http://localhost:8181. My angular login-form tries to make request to http://localhost:8181/token which I have specified in my login controller. Even though I have added cors configuration in server side, I get this error :-

Failed to load http://localhost:8181/token: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:4200' is therefore not allowed access. The response had HTTP status code 403.

(angular) login.service.ts:-

@Injectable()
export class LoginService {
  constructor(private http: Http) {}

  sendCredential(username: string, password: string) {
    const url = 'http://localhost:8181/token';
    const encodedCredential = username + ':' + password;
    const basicHeader = 'Basic ' + btoa(encodedCredential);
    const headers = new Headers();
    headers.append('Content-Type', 'application/x-wwww-form-urlencoded');
    headers.append('Authorization' ,  basicHeader);
    const opts = new RequestOptions({headers: headers});
    return this.http.get(url, opts);
  }

}

(spring) SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

private static final String[] PUBLIC_MATCHERS = {
            "/css/**",
            "/js/**",
            "/image/**",
            "/book/**",
            "/user/**"
    };

@Override
    protected void configure(HttpSecurity http) throws Exception{
        http
                .cors().and()
                .csrf().disable()
                .httpBasic()
                .and()
                .authorizeRequests()
                .antMatchers(PUBLIC_MATCHERS)
                .permitAll()
                .anyRequest()
                .authenticated();
    }
 @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("*"));
        configuration.setAllowedMethods(Arrays.asList("GET","POST","DELETE","PUT","OPTIONS"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userSecurityService).passwordEncoder(passwordEncoder());
    }

LoginController.java

@RestController
public class LoginController {

    @Autowired
    private UserService userService;

    @RequestMapping("/token")
    public Map<String, String> token(HttpSession session, HttpServletRequest request) {
        String remoteHost = request.getRemoteHost();
        int portNumber = request.getRemotePort();
        String remoteAddr = request.getRemoteAddr();

        System.out.println(remoteHost + ":" + portNumber);
        System.out.println(remoteAddr);


        return Collections.singletonMap("token", session.getId());
    }
}

I have added CORS configuration in SecurityConfig class as shown above in code block — Tsetiz Bista
– Tsetiz Bista, Commented Nov 1, 2017 at 14:58
problem is with your authentication mechanism, somehow it's not able to authenticate user. So it returns 403 status — Nitishkumar Singh
– Nitishkumar Singh, Commented Nov 1, 2017 at 15:03
when i use traditional approach where the class implement Filter interface and perform filterChain.doFilter for every request/response for cors handling instead of spring CorConfigurationSource it works fine. — Tsetiz Bista
– Tsetiz Bista, Commented Nov 1, 2017 at 15:15

vsoni · Accepted Answer · 2017-11-17 09:01:47Z

8

Try this configuration. It should work fine for you.

@Bean
CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("*"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "DELETE", "PUT", "PATCH"));
        configuration.setAllowedHeaders(Arrays.asList("X-Requested-With", "Origin", "Content-Type", "Accept", "Authorization"));
        configuration.setAllowCredentials(true);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

Since you are using spring security / authentication. You should use setAllowCredentials(true).

answered Nov 17, 2017 at 9:01

vsoni

2,96612 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

ancm Over a year ago

No matter what I do I'm getting 403. I am using KeycloakWebSecurityConfigurerAdapter with your code, I've tried a bunch of similar code.

vsoni Over a year ago

@ancm - it is very difficult to understand the exact problem without looking at the stack trace. Perhaps stackoverflow.com/questions/42153070/… or stackoverflow.com/questions/53493809/… or stackoverflow.com/questions/45051923/… might be helpful for you.

Joao Apr 26 at 23:04

Setting the [allowedOrigins = *] is a very bad idea (unless that's exactly what you want). Modern browsers follow the [Same-origin policy] to (somewhat) prevent "website A" from making requests to / loading resources from "website B" unless "website B"'s backend explicitly allows it. Setting [allowedOrigins = *] basically allows anyone to bypass this Same-origin policy. There's more to it, but this is the gist of it. Useful links: developer.mozilla.org/en-US/docs/Web/Security/… developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS

Harsha Biyani · Accepted Answer · 2018-11-19 05:12:12Z

4

I was stuck with this problem for 2 days and by adding @CrossOrigin("*") in controller solved my problem.

note: you can put your origin address instead of *

edited Nov 19, 2018 at 5:12

Harsha Biyani

7,28810 gold badges42 silver badges64 bronze badges

answered Nov 19, 2018 at 4:51

laynurraa

414 bronze badges

1 Comment

wael jawadi Over a year ago

Thank you, I was searching for a solution for this problem, for almost 6 hours.

Peter Rader · Accepted Answer · 2017-11-01 16:19:39Z

1

Use

@CrossOrigin("http://your-foreign-site/")
@RequestMapping("/token")

instead.

answered Nov 1, 2017 at 16:19

Peter Rader

2453 silver badges14 bronze badges

1 Comment

Tsetiz Bista Over a year ago

But I want to add cors configuration in global level. Not in the controller.

stfbee · Accepted Answer · 2017-12-27 11:12:28Z

0

Add

<mvc:cors>
    <mvc:mapping path="/**" />
</mvc:cors>

to your web.xml to allow connections from all hosts

Origin: https://spring.io/blog/2015/06/08/cors-support-in-spring-framework

answered Dec 27, 2017 at 11:12

stfbee

4305 silver badges10 bronze badges

Comments

Amr Alaa · Accepted Answer · 2017-11-17 04:35:18Z

-1

inside your controller use the value from a .properties file

@Value("${cors.site.enable}") private String site;

use @crossOrigin(site)

answered Nov 17, 2017 at 4:35

Amr Alaa

5533 silver badges7 bronze badges

Collectives™ on Stack Overflow

spring CORS and angular not working : HTTP status code 403 error

5 Answers 5

3 Comments

1 Comment

1 Comment

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

3 Comments

1 Comment

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related