How to CORS bypass in Spring? - spring-boot

Question

I create applications - API client in Spring Boot with RestTemplate.
The API (not mine) probably has CORS, besouce in console I get 403, but in browser/postman is ok.
How to bypass CORS?
public Pokemontcg getPokemontcg() {
RestTemplate restTemplate = new RestTemplate();
Pokemontcg forObject = restTemplate.getForObject("https://api.pokemontcg.io/v1/cards?name=charizard", Pokemontcg.class);
return forObject;
}
Result
"main" org.springframework.web.client.HttpClientErrorException$Forbidden: 403 Forbidden

Answer 1

There are multiple ays. One of the most efficient is
doing it in JavaConfig
#Configuration
#EnableWebMvc
public class WebConfig implements WebMvcConfigurer {
#Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**");
}
}
Or the simplest ways is
Controller Method CORS Configuration
Enabling CORS is straightforward – just add the annotation #CrossOrigin.
We may implement this in a number of different ways.
#CrossOrigin on a #RequestMapping-Annotated Handler Method
#RestController
#RequestMapping("/account")
public class AccountController {
#CrossOrigin
#RequestMapping("/{id}")
public Account retrieve(#PathVariable Long id) {
// ...
}
If you want client-side solution here is the solution
Consider this example.
Your server is my-server.com and your client is my-client.com Configure nginx as follows:
// nginx.conf
upstream server {
server my-server.com;
}
upstream client {
server my-client.com;
}
server {
listen 80;
server_name my-website.com;
access_log /path/to/access/log/access.log;
error_log /path/to/error/log/error.log;
location / {
proxy_pass http://client;
}
location ~ /server/(?<section>.*) {
rewrite ^/server/(.*)$ /$1 break;
proxy_pass http://server;
}
}
Here my-website.com will be the resultant name of the website where the code will be accessible (name of the proxy website). Once nginx is configured this way. You will need to modify the requests such that:
All API calls change from my-server.com/<API-path> to my-website.com/server/<API-path>

Answer 2

Oh, boi you have an absolutely different issue. It is not something bad with your code.
Read this thread https://github.com/simonprickett/allthepokemon/issues/1
Per this please change your endpoint to http://pokeapi.salestock.net/api/v2/
If this also doesn't help use https://cors.now.sh/https://your_URL.
https://cors.now.sh enables reverse proxy and with absolute URLs will definitely work.
That's quite a weird solution but it is what it is.

Answer 3

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Component;
#Component
public class SimpleCORSFilter implements Filter {
private final Logger log = LoggerFactory.getLogger(SimpleCORSFilter.class);
public SimpleCORSFilter() {
log.info("SimpleCORSFilter init");
}
#Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
response.setHeader("Access-Control-Max-Age", "3600");
response.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me");
chain.doFilter(req, res);
}
#Override
public void init(FilterConfig filterConfig) {
}
#Override
public void destroy() {
}
}