Why getting CORS error in Spring Security - spring

Question

My backend application is Spring boot and frontend application is React. I am trying to access spring boot app from react and getting this error:
there is some spring security configuration;
#Bean
public CorsFilter corsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOrigin("*");
config.addAllowedHeader("*");
config.addAllowedMethod("OPTIONS");
config.addAllowedMethod("HEAD");
config.addAllowedMethod("GET");
config.addAllowedMethod("PUT");
config.addAllowedMethod("POST");
config.addAllowedMethod("DELETE");
config.addAllowedMethod("PATCH");
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);
}
/**
* This method is permitting endpoints
* #author ***
* */
#Override
public void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
.cors()
.and()
.csrf().disable()
.exceptionHandling().authenticationEntryPoint(handler).and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
.authorizeRequests()
.antMatchers("/auth/**", "/swagger-ui.html", "/swagger-ui/index.html", "/swagger-ui/**", "/v3/api-docs/**")
.permitAll()
.anyRequest().authenticated();
httpSecurity.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
}
and there is a JWT filter;
#Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
try {
String jwt = extractJwtFromRequest(request);
if (jwt != null && jwtTokenProvider.validateJwtToken(jwt)) {
String username = jwtTokenProvider.getUserIdFromJwtToken(jwt);
UserDetails userDetails = userDetailsServiceImp.loadUserByUsername(username);
if (userDetails != null) {
UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(
userDetails,
null,
userDetails.getAuthorities()
);
authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authenticationToken);
}
}
} catch (Exception e) {
e.printStackTrace();
}
filterChain.doFilter(request, response);
}
finally request from react in the network tab;
Getting;
java.lang.IllegalArgumentException: When allowCredentials is true, allowedOrigins cannot contain the special value "*" since that cannot be set on the "Access-Control-Allow-Origin" response header. To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead.
from backend server.

Answer 1

Your problem is because you have set
config.setAllowCredentials(true);
in combination with:
config.addAllowedOrigin("*");
setAllowCredentials means that the response will include the Access-Control-Allow-Credentials header with the value true to the calling client. This header will set if the javascript in the browser is allowed to access credential information like session cookies, authorization headers or TLS client certificates.
You have essentially set that ANY origin (since you are using a wildcard *) is allowed to touch/use the credential information that gets sent back.
This is very unsecure
And thats what the warning is telling you:
When allowCredentials is true, allowedOrigins cannot contain the special
value "*" since that cannot be set on the "Access-Control-Allow-Origin" response header.
To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead.
You cannot have allowCredentials to true and allowedOrigins to * at the same time.
If you want the javascript in the browser to be able to touch credential information, you must explicitly set what origins that are allowed using the allowedOriginPatterns.
For instance:
final List<String> allowedOrigins = new ArrayList<>()
allowedOrigins.add("http://127.0.0.1:6161");
config.allowedOriginPatterns(allowedOrigins);
Or you just disable the allow credentials all together.