[Spring Security/SAML2/SSO/Reverse Proxy]: CORS Error after some Minutes (when Session expires) and server sends 302 redirect rather than 200 OK

I'm using Spring Security for my Spring REST backend running on a Tomcat behind a Reverse Proxy with Shibboleth and a SAML 2 Identity Provider.

The Backend has a Rest API which is consumed by my angular frontend, both provided in the same WAR, hence both running on the same Tomcat.

The app runs normally in the beginning, but after 5 minutes I receive a CORS error.

This is what happens:

200 OK: GET https://hello.test.mypage.com/api/somerequest

5 Minutes later on same request:
302 Found: GET https://hello.test.mypage.com/api/somerequest
CORS Missing Allow Origin
302: GET https://myidp.mypage.com/bla/public/saml2sso?SAMLERequest=xxx

Source of my Cors Config:

  @Bean
  CorsConfigurationSource corsConfigurationSource() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedMethods(Arrays.asList(
            HttpMethod.GET.name(),
            HttpMethod.POST.name(),
            HttpMethod.PUT.name(),
            HttpMethod.HEAD.name(),
            HttpMethod.POST.name(),
            HttpMethod.OPTIONS.name()
    ));

    configuration.setAllowedOriginPatterns(List.of("https://*.mypage.com"));
    configuration.setAllowedHeaders(Collections.singletonList(ALL));
    configuration.setMaxAge(1800L);

    source.registerCorsConfiguration("/**", configuration);
    return source;
  }

This clearly has to do with the session expiration of 5 Minutes of the SSO. But I don't fully understand why the token refresh causes a CORS error.

What solutions are there for this problem?