CODEWITHSUNDEEP
springspring-securitycors
tim.a
tim.a

Reputation: 83

No 'Access-Control-Allow-Origin' header is present on the requested resource (Spring)

I know there are a lot threads on the forum about this issue but still haven't figure out a solution.

So, I have deployed two applications in a private JVM/tomcat 8.5.30 on my vps. The one is my ROOT.war and the other one is the admin.war They were accesible from http://example.com and http://example.com/admin

Before I installed a ssl certificate everything worked fine. After installing it and forcing https redirect I am facing a problem with my admin.war (now they are both accesible from https://example.com and https://example.com/admin)

My admin works with a lot of jquery (I cannot change that) and I am getting this error every time I am trying to submit something

Access to XMLHttpRequest at 'http: //example.com/admin/add' from origin 'https: //example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

So I am trying to fix this via spring security. In my security configuration I have

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
public class SiteSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .cors().and()
         //.....
         }


  @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
        configuration.setAllowedHeaders(Arrays.asList("Access-Control-Allow-Headers"));
        configuration.addExposedHeader("Access-Control-Allow-Headers");
        configuration.setAllowedMethods(Arrays.asList("POST"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

I do this for both my root app and my admin app ( I don't know if that's correct to do it for both of them). Still doesn't work.

Any help?

thanks!!

Upvotes: 0

Views: 175

Answers (1)

MyTwoCents
MyTwoCents

Reputation: 7624

If you see Error 

'http://example.com/admin/add' from origin 'https://example.com' has been blocked

There are 2 issues

1 I guess your /add API call is not getting redirected to https. Ideally it should be https://example.com/admin/add Either you resolve this

or

2 Change setAllowedOrigins in your Admin App to http as well like this

@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("https://example.com", "http://example.com"));
    configuration.setAllowedHeaders(Arrays.asList("Access-Control-Allow-Headers"));
    configuration.addExposedHeader("Access-Control-Allow-Headers");
    configuration.setAllowedMethods(Arrays.asList("POST"));
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

Upvotes: 1

Related Questions