Swagger UI oauth cookie interfering with Spring boot security oauth? - spring-boot

Question

I added springdoc-openapi-ui 1.6.12 in my Spring Boot project. I configured oAuth2 with PKCE and everything works fine, when I click on the "authorize" button it redirects me to a sso connection page. Then, I can send requests via swagger ui.
The problem is that it interferes with my Angular front end authentication. The front loops on the /login rout, with a 401 error. Swagger oauth uses the same session cookie as Spring Security/Angular.
Is there a way to use the same session for swagger ui AND angular ? Or is the problem somewhere else ?
This is my configuration :
springdoc:
swagger-ui:
path: /api-docs
tagsSorter: alpha
oauth:
clientId: "XXX"
clientSecret: "XXX"
use-pkce-with-authorization-code-grant: true
oAuthFlow:
authorizationUrl: "XXX/as/authorization.oauth2"
tokenUrl: "XXX/as/token.oauth2"
scope : XXX profile groups XXX email
edit :
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.cors().configurationSource(corsConfigurationSource())
.and().csrf().disable()
.headers()
.frameOptions().disable()
.httpStrictTransportSecurity()
.includeSubDomains(false)
.maxAgeInSeconds(60*60*24*5)
.and().and()
.authorizeRequests(a -> a
// Management endpoints
.antMatchers(
"/health" + MATCH_ALL,
"/info",
"/prometheus",
"/loggers" + MATCH_ALL,
"/metrics" + MATCH_ALL
).permitAll()
// Authentication
.antMatchers(Routes.CURRENT_USER).permitAll()
.antMatchers("/oauth2/authorization/XXX").permitAll()
.antMatchers(Routes.LOGIN).authenticated()
// Preflight requests
.antMatchers(HttpMethod.OPTIONS).permitAll()
// Applications
.antMatchers(Routes.XXX.BASE + MATCH_ALL).hasAuthority(AuthorityUtil.AUTHORITY_XXX)
)
// By setting the login page here, Spring won't ask which provider we want to use
.oauth2Login().loginPage("/oauth2/authorization/XXX")
.and()
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::opaqueToken)
;
}
#Bean
public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration config = new CorsConfiguration();
config.applyPermitDefaultValues();
config.setAllowedOriginPatterns(List.of("*"));
config.setAllowedMethods(List.of("*"));
config.setAllowedHeaders(List.of("*"));
config.setAllowCredentials(true);
config.setMaxAge(1800L);
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration(MATCH_ALL, config);
return source;
}