CORS issue between Angular 10 and Spring Boot 1.5 - spring-boot

Question

I just can't solve a CORS issue between my angular 10 application and spring boot 1.5.
I've tried everything that i can and it's still not working.
I'm trying to set a global CORS config to allow everything
My current implementation:
#Configuration
public class DevConfig {
#Bean
public WebMvcConfigurer corsConfigurer() {
return new WebMvcConfigurerAdapter() {
#Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins("http://localhost:4200")
.allowedHeaders("*");
}
};
}
}
And I'm getting this on the frontend side:
Access to XMLHttpRequest at 'http://localhost:8080/test' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource
Version
<properties>
<java.version>1.8</java.version>
<commons-io.version>2.7</commons-io.version>
<spring.version>1.5.9.RELEASE</spring.version>
</properties>
[EDIT]
I've changed that to this:
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import java.util.Arrays;
#Configuration
public class AppConfig {
#Bean
CorsConfigurationSource corsConfigurationSource()
{
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList("http://localhost:4200"));
configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "DELETE", "PUT", "PATCH"));
configuration.setAllowedHeaders(Arrays.asList("X-Requested-With", "Origin", "Content-Type", "Accept", "Authorization"));
configuration.setAllowCredentials(true);
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
}
And it's still not working

Answer 1

Add #CrossOrigin(origins="http://localhost:4200") in the method or controller level in your RestController. Or,
If you want to add global configuration, configure this bean in your configuration file:
#Bean
CorsConfigurationSource corsConfigurationSource()
{
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList("http://localhost:4200"));
configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "DELETE", "PUT", "PATCH"));
configuration.setAllowedHeaders(Arrays.asList("X-Requested-With", "Origin", "Content-Type", "Accept", "Authorization"));
configuration.setAllowCredentials(true);
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
If you're using spring security, you should add configuration.setAllowCredentials(true); here too and don't forget to add http.cors() in spring security configuration.
Edit:
When the browser is making a cross-origin request, the browser adds an Origin header with the current origin (scheme, host, and port). On the server side, when a server sees this header, and wants to allow access, it needs to add an Access-Control-Allow-Origin header to the response specifying the requesting origin (or * to allow any origin.). When the browser sees this response with an appropriate Access-Control-Allow-Origin header, the browser allows the response data to be shared with the client site.
If your backend is sending the header, this might likely be that Chrome does not support localhost to go through the Access-Control-Allow-Origin. To have Chrome send Access-Control-Allow-Origin in the header, just alias your localhost in your /etc/hosts file to some other domain, like:
127.0.0.1 localhost yourdomain.com
Then if you'd access your api using yourdomain.com instead of localhost, the call should succeed.
If the problem still exist, You need to check whether any header is sent by the backend. If not, add that to response headers (that's nasty). Let me know what actually happened.