Springboot 3.0 cannot config CORS - spring-boot

Question

I try to configure CORS policy, but it doesn't work.
When i send a request i recieve headers like this:
* Mark bundle as not supporting multiuse
< HTTP/1.1 200
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 0
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< X-Frame-Options: DENY
< Content-Type: application/json
< Transfer-Encoding: chunked
< Date: Mon, 13 Feb 2023 10:33:36 GMT
with no allow-origins. How can i fix this problem?
Spring security config code:
#Configuration
#EnableWebSecurity
#EnableMethodSecurity
public class JWTSecurityConfig {
//here is jwt setting
...
#Bean
public SecurityFilterChain filterChain(HttpSecurity http, Jwt2AuthenticationConverter authenticationConverter, ServerProperties serverProperties) throws Exception {
http.oauth2ResourceServer().jwt().jwtAuthenticationConverter(authenticationConverter);
http.anonymous();
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.csrf().disable().cors().disable();
http.exceptionHandling().authenticationEntryPoint((request, response, authException) -> {
response.addHeader(HttpHeaders.WWW_AUTHENTICATE, "Basic realm=\"Restricted Content\"");
response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
});
if (serverProperties.getSsl() != null && serverProperties.getSsl().isEnabled()) {
http.requiresChannel().anyRequest().requiresSecure();
} else {
http.requiresChannel().anyRequest().requiresInsecure();
}
http.authorizeRequests().requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.and().authorizeRequests().requestMatchers("/swagger-ui/**", "/api-docs/**").permitAll()
.and().authorizeRequests().requestMatchers(HttpMethod.GET, "/attributes/questions", "/attr-values/recent-values", "/attr-values/history").hasAuthority("default-roles-ai-solutions").requestMatchers(HttpMethod.POST, "/attr-values/save-attr-values").hasAuthority("default-roles-ai-solutions").anyRequest().authenticated().and().oauth2ResourceServer().jwt();
return http.build();
}
#Bean
CorsConfigurationSource corsConfigurationSource() {
final var configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList("*"));
configuration.setAllowedMethods(Arrays.asList("GET"));
configuration.setAllowedHeaders(Arrays.asList("*"));
configuration.setExposedHeaders(Arrays.asList("*"));
final var source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
}
dependencies in pom.xml
spring-boot-starter-web:3.0.0
spring-boot-starter-data-jpa: 3.0.0
spring-boot-starter-oauth2-resource-server:3.0.0
When i enable cors like this:
http.cors().configurationSource(corsConfigurationSource());
i recieve if request isn't correct:
* Mark bundle as not supporting multiuse
< HTTP/1.1 403
< Vary: Origin
< Vary: Access-Control-Request-Method
< Vary: Access-Control-Request-Headers
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 0
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< X-Frame-Options: DENY
< Transfer-Encoding: chunked
< Date: Mon, 13 Feb 2023 12:46:25 GMT
if it's correct request:
Mark bundle as not supporting multiuse
< HTTP/1.1 200
< Vary: Origin
< Vary: Access-Control-Request-Method
< Vary: Access-Control-Request-Headers
< Allow: GET,HEAD,OPTIONS
< Accept-Patch:
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 0
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< X-Frame-Options: DENY
< Content-Length: 0
< Date: Mon, 13 Feb 2023 13:28:44 GMT
part with jwt config
public interface Jwt2AuthoritiesConverter extends Converter<Jwt, Collection<? extends GrantedAuthority>> {
}
#SuppressWarnings("unchecked")
#Bean
public Jwt2AuthoritiesConverter authoritiesConverter() {
// This is a converter for roles as embedded in the JWT by a Keycloak server
// Roles are taken from both realm_access.roles & resource_access.{client}.roles
return jwt -> {
final var realmAccess = (Map<String, Object>) jwt.getClaims().getOrDefault("realm_access", Map.of());
final var realmRoles = (Collection<String>) realmAccess.getOrDefault("roles", List.of());
final var resourceAccess = (Map<String, Object>) jwt.getClaims().getOrDefault("resource_access", Map.of());
// We assume here you have "employee-service" (as in the tutorial referenced in the question) and "other-client" clients configured with "client roles" mapper in Keycloak
final var confidentialClientAccess = (Map<String, Object>) resourceAccess.getOrDefault("employee-service", Map.of());
final var confidentialClientRoles = (Collection<String>) confidentialClientAccess.getOrDefault("roles", List.of());
final var publicClientAccess = (Map<String, Object>) resourceAccess.getOrDefault("other-client", Map.of());
final var publicClientRoles = (Collection<String>) publicClientAccess.getOrDefault("roles", List.of());
final var realmScopes = Arrays.asList(((String) jwt.getClaims().getOrDefault("scope", "")).split(" "));
realmScopes.replaceAll(scope -> "SCOPE_" + scope);
final var grantedAuthorityScopes = (Collection<String>) realmScopes;
return Stream.concat(realmRoles.stream(), Stream.concat(confidentialClientRoles.stream(), Stream.concat(publicClientRoles.stream(), grantedAuthorityScopes.stream()))).map(SimpleGrantedAuthority::new).toList();
};
}
public interface Jwt2AuthenticationConverter extends Converter<Jwt, AbstractAuthenticationToken> {
}
#Bean
public Jwt2AuthenticationConverter authenticationConverter(Jwt2AuthoritiesConverter authoritiesConverter) {
return jwt -> new JwtAuthenticationToken(jwt, authoritiesConverter.convert(jwt));
}
I expect to recieve:
Access-Control-Allow-Origin: *

Answer 1

I think the error is at line: http.csrf().disable().cors().disable();. You should use istead http.csrf().disable().cors().configurationSource(corsConfigurationSource()); and the method corsConfigurationSource is not a #Bean.
#Configuration
#EnableWebSecurity
#EnableMethodSecurity
public class JWTSecurityConfig {
...
#Bean
public SecurityFilterChain filterChain(HttpSecurity http, Jwt2AuthenticationConverter authenticationConverter, ServerProperties serverProperties) throws Exception {
http.oauth2ResourceServer().jwt().jwtAuthenticationConverter(authenticationConverter);
http.anonymous();
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.csrf().disable().cors().configurationSource(corsConfigurationSource());
http.exceptionHandling().authenticationEntryPoint((request, response, authException) -> {
response.addHeader(HttpHeaders.WWW_AUTHENTICATE, "Basic realm=\"Restricted Content\"");
response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
});
if (serverProperties.getSsl() != null && serverProperties.getSsl().isEnabled()) {
http.requiresChannel().anyRequest().requiresSecure();
} else {
http.requiresChannel().anyRequest().requiresInsecure();
}
http.authorizeRequests().requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.and().authorizeRequests().requestMatchers("/swagger-ui/**", "/api-docs/**").permitAll()
.and().authorizeRequests().requestMatchers(HttpMethod.GET, "/attributes/questions", "/attr-values/recent-values", "/attr-values/history").hasAuthority("default-roles-ai-solutions").requestMatchers(HttpMethod.POST, "/attr-values/save-attr-values").hasAuthority("default-roles-ai-solutions").anyRequest().authenticated().and().oauth2ResourceServer().jwt();
return http.build();
}
CorsConfigurationSource corsConfigurationSource() {
final var configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList("*"));
configuration.setAllowedMethods(Arrays.asList("GET"));
configuration.setAllowedHeaders(Arrays.asList("*"));
configuration.setExposedHeaders(Arrays.asList("*"));
final var source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
}
EDITED
You should replace configuration.setAllowedOrigins(Arrays.asList("*")) with configuration.addAllowedOriginPattern("*").
CorsConfigurationSource corsConfigurationSource() {
final var configuration = new CorsConfiguration();
configuration.addAllowedOriginPattern("*");
configuration.setAllowedMethods(Arrays.asList("GET"));
configuration.setAllowedHeaders(Arrays.asList("*"));
configuration.setExposedHeaders(Arrays.asList("*"));
final var source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}

Answer 2

Both #david-pérez-cabrera and #m-denium are right
Replace cors().disable() with configurationSource(corsConfigurationSource()).
Your authentication converter is not picked
Spring-boot expects a Converter<Jwt, ? extends AbstractAuthenticationToken> bean when you provide a Converter<Jwt, AbstractAuthenticationToken>, and guess what?, AbstractAuthenticationToken does not extend AbstractAuthenticationToken...
The 403 you get with http.cors().configurationSource(corsConfigurationSource()); is probably not a CORS error.
Given your conf, my guess (we don't have the details of the requests you attempt) is that you are missing the default-roles-ai-solutions authority when issuing either:
a GET request to one of "/attributes/questions", "/attr-values/recent-values", "/attr-values/history"
a POST request to "/attr-values/save-attr-values"
Two options:
correctly copy from my code, including this part: oauth2ResourceServer().jwt().jwtAuthenticationConverter(...)
change your Jwt2AuthenticationConverter interface definition from extends Converter<Jwt, AbstractAuthenticationToken> to extends Converter<Jwt, JwtAuthenticationToken>