Geek Answers Handbook

Spring 401 boot support service options on oauth / token

I use spring boot to make a simple holiday service. To use it in Angular 2, I have a problem with CORS when extracting a token to the oauth / token endpoint.

Chrome error message below.

error message

zone.js:101 OPTIONS http://192.168.0.9:8080/api/oauth/token XMLHttpRequest cannot load http://192.168.0.9:8080/api/oauth/token. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access. The response had HTTP status code 401.

Related files are below.

Myconfig.java

 @Configuration public class MyConfig { @Bean public WebMvcConfigurer corsConfigurer() { return new WebMvcConfigurerAdapter() { @Override public void addCorsMappings(CorsRegistry registry) { registry.addMapping("**") .allowedOrigins("*").allowedMethods("POST, GET, HEAD, OPTIONS") .allowCredentials(true) .allowedHeaders("Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers") .exposedHeaders("Access-Control-Allow-Origin,Access-Control-Allow-Credentials") .maxAge(10); } }; } }

OAuth2ResourceServerConfig.java

 @Configuration @EnableResourceServer class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter { @Override public void configure(HttpSecurity http) throws Exception { http .csrf().disable() .anonymous() .and() .authorizeRequests() .antMatchers(HttpMethod.OPTIONS,"**").permitAll() .antMatchers("/authenticated/**").authenticated() ; } }

I am new to java and spring. I found the same question as OAuth2 - Status 401 in an OPTIONS request when searching for TOKEN , but I really don't understand how to make it work in spring boot.

Note that the endpoint of the breakpoint controller is working fine. The problem is that oauth / token, requesting parameters returns 401 status.

Please show me some working code in spring boot. Thanks!

+10
source share
3 answers

You can add this CORS filter to your project.

  @Component @Order(Ordered.HIGHEST_PRECEDENCE) public class SimpleCORSFilter implements Filter { @Override public void init(FilterConfig fc) throws ServletException { } @Override public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException { HttpServletResponse response = (HttpServletResponse) resp; HttpServletRequest request = (HttpServletRequest) req; response.setHeader("Access-Control-Allow-Origin", "*"); response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE"); response.setHeader("Access-Control-Max-Age", "3600"); response.setHeader("Access-Control-Allow-Headers", "x-requested-with, authorization, Content-Type, Authorization, credential, X-XSRF-TOKEN"); if ("OPTIONS".equalsIgnoreCase(request.getMethod())) { response.setStatus(HttpServletResponse.SC_OK); } else { chain.doFilter(req, resp); } } @Override public void destroy() { } }
+19
source

if you use spring boot + spring OAuth you should add

 @Order(Ordered.HIGHEST_PRECEDENCE)

for filter CORS

 @Configuration @Order(Ordered.HIGHEST_PRECEDENCE) public class CORSFilter implements Filter { private FilterConfig config; public static final String CREDENTIALS_NAME = "Access-Control-Allow-Credentials"; public static final String ORIGIN_NAME = "Access-Control-Allow-Origin"; public static final String METHODS_NAME = "Access-Control-Allow-Methods"; public static final String HEADERS_NAME = "Access-Control-Allow-Headers"; public static final String MAX_AGE_NAME = "Access-Control-Max-Age"; @Override public void destroy() { } @Override public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException { HttpServletResponse response = (HttpServletResponse) resp; HttpServletRequest request = (HttpServletRequest) req; response.setHeader("Access-Control-Allow-Origin", "*"); response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE"); response.setHeader("Access-Control-Max-Age", "3600"); response.setHeader("Access-Control-Allow-Headers", "x-requested-with, authorization, Content-Type, Authorization, credential, X-XSRF-TOKEN"); if ("OPTIONS".equalsIgnoreCase(request.getMethod())) { response.setStatus(HttpServletResponse.SC_OK); } else { chain.doFilter(req, resp); } } @Override public void init(FilterConfig filterConfig) throws ServletException { config = filterConfig; } }
+5
source

Here is the root Spring Framework solution:

 @Bean public CorsFilter corsFilter(CorsConfiguration config) { log.debug("Registering CORS filter"); UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); source.registerCorsConfiguration("/api/**", config); source.registerCorsConfiguration("/v2/api-docs", config); source.registerCorsConfiguration("/oauth/**", config); return new CorsFilter(source); }
+2
source

More articles:


All Articles