Standalone Spring OAuth2 JWT Authorization Server + CORS -

so have following authorization server condensed this example dave syer

@springbootapplication public class authserverapplication {      public static void main(string[] args) {             springapplication.run(authserverapplication.class, args);     }      /* added later     @configuration     @order(ordered.highest_precedence)     protected static class mywebsecurity extends websecurityconfigureradapter {          @override         protected void configure(httpsecurity http) throws exception {             http //.csrf().disable()                  .authorizerequests()                 .antmatchers(httpmethod.options, "/oauth/token").permitall();        }     }*/      @configuration     @enableauthorizationserver     protected static class oauth2authorizationconfig extends                     authorizationserverconfigureradapter {              @autowired             private authenticationmanager authenticationmanager;              @bean             public jwtaccesstokenconverter jwtaccesstokenconverter() {                     jwtaccesstokenconverter converter = new jwtaccesstokenconverter();                     keypair keypair = new keystorekeyfactory(                                     new classpathresource("keystore.jks"), "foobar".tochararray())                                     .getkeypair("test");                     converter.setkeypair(keypair);                     return converter;             }              @override             public void configure(clientdetailsserviceconfigurer clients) throws exception {                     clients.inmemory()                                     .withclient("acme")                                     //.secret("acmesecret")                                     .authorizedgranttypes(//"authorization_code", "refresh_token",                                                     "password").scopes("openid");             }              @override             public void configure(authorizationserverendpointsconfigurer endpoints)                             throws exception {                     endpoints.authenticationmanager(authenticationmanager).accesstokenconverter(                                     jwtaccesstokenconverter());             }              @override             public void configure(authorizationserversecurityconfigurer oauthserver)                             throws exception {                     oauthserver.tokenkeyaccess("permitall()").checktokenaccess(                                     "isauthenticated()");             }     } } 

when run , test curl

curl acme@localhost:8110/oauth/token -d grant_type=password -d client_id=acme -d username=user -d password=password 

i jwt respons, try access authserver frontend (angular js on different port) cors error. not becauce of missing headers, because option request rejected , missing credentials.

request url:http://localhost:8110/oauth/token request method:options status code:401 unauthorized www-authenticate:bearer realm="oauth", error="unauthorized", error_description="full authentication required access resource" 

i knew have add corsfilter , additionally found this post used the snippet first answer let options request access /oauth/token without credentials:

@order(-1) public class mywebsecurity extends websecurityconfigureradapter {    @override    protected void configure(httpsecurity http) throws exception {        http           .authorizerequests()           .antmatchers(httpmethod.options, "/oauth/token").permitall();    } } 

after got curl following error:

{"timestamp":1433370068120,"status":403,"error":"forbidden","message":"expected csrf token not found. has session expired?","path":"/oauth/token"} 

so make simple added http.csrf().disable() configure method of mywebsecurity class, solves problem option request, therefore post request isn't working anymore , there no client authentication. try adding appropriate authentication filter. (also curl).

i tried find out if have somehow connect mywebsecurity class , authserver, without luck. original example (link in beginning) injects authenticationmanager, changed nothing me.

found reason problem!

i needed end filterchain , return result immediatly if options request processed corsfilter!

simplecorsfilter.java

@component @order(ordered.highest_precedence) public class simplecorsfilter implements filter {      public simplecorsfilter() {     }      @override     public void dofilter(servletrequest req, servletresponse res, filterchain chain) throws ioexception, servletexception {         httpservletresponse response = (httpservletresponse) res;         httpservletrequest request = (httpservletrequest) req;         response.setheader("access-control-allow-origin", "*");         response.setheader("access-control-allow-methods", "post, get, options, delete");         response.setheader("access-control-max-age", "3600");         response.setheader("access-control-allow-headers", "x-requested-with, authorization");          if ("options".equalsignorecase(request.getmethod())) {             response.setstatus(httpservletresponse.sc_ok);         } else {             chain.dofilter(req, res);         }     }      @override     public void init(filterconfig filterconfig) {     }      @override     public void destroy() {     } } 

after ignore options preflight request in authserver =d

so server works in snipped above , can ignore block comment mywebsecurity class in beginning.