Getting No 'Access-Control-Allow-Origin' header error with Google OAuth, spring boot and react app

Viewed 37

I have a React UI server running at https://uiserver/login When I load https://uiserver/login in the browser, it makes call to my REST end point at API server: http://restapiserver/api/user. This api server is built with spring boot and spring security. This REST endpoint requires you to be authenticated with google. So it redirects to google login screen. When I enter my google credentials, it gives me error in browser console:

Access to XMLHttpRequest at 'https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=<clientid>&scope=openid%20profile%20email&state=<state>&redirect_uri=http://restapiserver/login/oauth2/code/google&nonce=<nounce>' (redirected from 'http://restapiserver/api/user') from origin 'https://uiserver' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

It also gives following net::ERR_FAILED 200 error in the browser console:

GET https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=<client_id>&scope=openid%20profile%20email&state=<state>&redirect_uri=http://restapiserver/login/oauth2/code/google&nonce=<nounce> net::ERR_FAILED 200 

I have added https://uiserver to Authorized JavaScript origins list for my Google OAuth app n Googles Developer Console. I have also added http://restapiserver/login/oauth2/code/google to Authorized redirect URIs list. Still why I am getting this error?

Update

I have following in my spring boot OAuth config:

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    final CorsConfiguration configuration = new CorsConfiguration();         
    configuration.setAllowedOrigins(ImmutableList.of("https://uiserver")); 
    configuration.setAllowedMethods(ImmutableList.of("HEAD","GET", "POST", "PUT", "DELETE", "PATCH")); 
    configuration.setAllowCredentials(true); 
    configuration.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type")); 
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); 
    source.registerCorsConfiguration("/**", configuration); return source; 
}

With this, it used to work perferctly when I had run it locally.

0 Answers
Related