1

We tried to implement Oauth2 in Spring with below config:

<sec:http pattern="/oauth/token" create-session="stateless"
    authentication-manager-ref="authenticationManager">
    <sec:intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"
        method="GET" />
    <sec:anonymous enabled="false" />
    <sec:http-basic entry-point-ref="clientAuthenticationEntryPoint" />
    <sec:custom-filter ref="clientCredentialsTokenEndpointFilter"
        before="BASIC_AUTH_FILTER" />
    <sec:access-denied-handler ref="oauthAccessDeniedHandler" />
</sec:http>

But when we call the /oauth/token from another domain, we got the 403 error. How to configure the CORS for the /oauth/token?

Ali Dehghani
  • 46,221
  • 15
  • 164
  • 151
TaiNguyen
  • 23
  • 4

1 Answers1

1

Add this filter to dispatcherServlet to root (/*) and above pattern:

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class SimpleCORSFilter implements Filter {

    public SimpleCORSFilter() {
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        HttpServletRequest request = (HttpServletRequest) req;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "x-requested-with, authorization, x-auth-token, origin, content-type, accept");

        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else {
            chain.doFilter(req, res);
        }
    }

    @Override
    public void init(FilterConfig filterConfig) {
    }

    @Override
    public void destroy() {
    }
}

Registration: 

FilterRegistration corsFilterReg = servletContext.addFilter("simpleCORSFilter", SimpleCORSFilter.class);
        corsFilterReg.addMappingForUrlPatterns(null, false, "/*");
Gazeciarz
  • 516
  • 1
  • 8
  • 22
  • FilterRegistration corsFilterReg = servletContext.addFilter("simpleCORSFilter", SimpleCORSFilter.class); corsFilterReg.addMappingForUrlPatterns(null, false, "/*"); – Gazeciarz Aug 28 '16 at 06:42
  • Thanks you for your support. Where do we register the SimpleCORSFilter? – TaiNguyen Aug 28 '16 at 06:49
  • In class which implements WebApplicationInitializer in public void onStartup(final ServletContext servletContext) throws ServletException method – Gazeciarz Aug 28 '16 at 06:51
  • Or if you use xml register it in web.xml like here: https://www.mkyong.com/spring-mvc/how-to-register-a-servlet-filter-in-spring-mvc/ – Gazeciarz Aug 28 '16 at 06:52
  • At the moment, we use the traditional, XML-based approach. As your suggestion, we should to change it to code-base approach? – TaiNguyen Aug 28 '16 at 06:56
  • You can use xml if You want to:) Please check tutorial in previous comment how to register it. I prefer java config because its easier and faster to maintain. From spring 4 there is a huge boost for java config (spring security in example) so I think in futute relases xml way may be deprecated. – Gazeciarz Aug 28 '16 at 07:00
  • Thanks you, The request to it is 200 OK. But we cannot load response with the error: Request header field access-control-allow-origin is not allowed by Access-Control-Allow-Headers in preflight response. Do we have any config on the filter? – TaiNguyen Aug 28 '16 at 07:19
  • Hmmm nothing more than that. Maybe its something on javascript side? https://www.google.pl/url?sa=t&source=web&rct=j&url=http://stackoverflow.com/questions/25727306/request-header-field-access-control-allow-headers-is-not-allowed-by-access-contr&ved=0ahUKEwihj4TPyuPOAhXLVywKHVBWCWQQFggaMAA&usg=AFQjCNHLwIriXQC5ACnTZ0JaOv1ZBSDSkg&sig2=S98hgscV4s_QFFt1K3TOmQ – Gazeciarz Aug 28 '16 at 11:46