I have a React UI server running at https://uiserver/login
When I load https://uiserver/login in the browser, it makes call to my REST end point at API server: http://restapiserver/api/user. This api server is built with spring boot and spring security. This REST endpoint requires you to be authenticated with google. So it redirects to google login screen. When I enter my google credentials, it gives me error in browser console:
Access to XMLHttpRequest at 'https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=<clientid>&scope=openid%20profile%20email&state=<state>&redirect_uri=http://restapiserver/login/oauth2/code/google&nonce=<nounce>' (redirected from 'http://restapiserver/api/user') from origin 'https://uiserver' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
It also gives following net::ERR_FAILED 200 error in the browser console:
GET https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=<client_id>&scope=openid%20profile%20email&state=<state>&redirect_uri=http://restapiserver/login/oauth2/code/google&nonce=<nounce> net::ERR_FAILED 200
I have added https://uiserver to Authorized JavaScript origins list for my Google OAuth app n Googles Developer Console. I have also added http://restapiserver/login/oauth2/code/google to Authorized redirect URIs list. Still why I am getting this error?
Update
I have following in my spring boot OAuth config:
@Bean
public CorsConfigurationSource corsConfigurationSource() {
final CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(ImmutableList.of("https://uiserver"));
configuration.setAllowedMethods(ImmutableList.of("HEAD","GET", "POST", "PUT", "DELETE", "PATCH"));
configuration.setAllowCredentials(true);
configuration.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type"));
final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration); return source;
}
With this, it used to work perferctly when I had run it locally.