1

I am getting the below issue while logging out from openid connect.

"Access to XMLHttpRequest at '' (redirected from '') from origin 'http://localhost:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource."

and the Network call is showing "cancelled" status.

Here is code SecurityConfig.java

@Override
    protected void configure(HttpSecurity http) throws Exception {
        LOG.info("in configure httpsecurity");
        http.csrf().disable().cors().and()
        .addFilterAfter(new OAuth2ClientContextFilter(), AbstractPreAuthenticatedProcessingFilter.class)
        .addFilterAfter(myFilter(), OAuth2ClientContextFilter.class)
        .httpBasic().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint(openIdConfig.getEntrypoint()))
        .and()
        .authorizeRequests()
        .antMatchers(openIdConfig.getEntrypoint()).permitAll()
        .anyRequest().authenticated()
        .and().logout()//.clearAuthentication(true)
        .logoutUrl(openIdConfig.getLogoffURL()+openIdConfig.getRedirectUri()).permitAll()
       .invalidateHttpSession(true)
          .deleteCookies(OpenIDConstants.SESSION_TOKEN, OpenIDConstants.USERNAME,
          OpenIDConstants.JSESSIONID)
          .logoutSuccessHandler(logoutSuccessHandler())
          .logoutSuccessUrl(openIdConfig.getRedirectUri());
        ;
        LOG.info("in configure httpsecurity end");
     // @formatter:on
    }
Anthony
  • 3,595
  • 2
  • 29
  • 38
Saritha
  • 63
  • 1
  • 2
  • 6

1 Answers1

1

You probably did enable CORS on security level, but not on the web level. To enable CORS on web level, you can do it at method level, class level or for the entire application.

Method level

@CrossOrigin(origins = "http://example.com")
@GetMapping(path="/")
public String homeInit(Model model) {
    return "home";
}

Class level

@CrossOrigin(origins = "*", allowedHeaders = "*")
@Controller
public class HomeController
{
    @GetMapping(path="/")
    public String homeInit(Model model) {
        return "home";
    }
}

Global

@Configuration
@EnableWebMvc
public class CorsConfiguration extends WebMvcConfigurerAdapter
{
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedMethods("GET", "POST");
    }
}

or, for a Spring Boot application, the recommended way:

@Configuration
public class CorsConfiguration
{
    @Bean
    public WebMvcConfigurer corsConfigurer()
    {
        return new WebMvcConfigurerAdapter() {
            @Override
            public void addCorsMappings(CorsRegistry registry) {
                registry.addMapping("/**");
            }
        };
    }
}