从 Spring Boot REST 端点访问 AWS Secrets Manager

Question

I'm trying to grab credentials from AWS Secrets Manager via a REST API endpoint that I've configured in Spring Boot. If I type in the URL of the endpoint + the parameter, I get the object that I expect. The site with the endpoint is hosted via AWS as well.

When I try to access the endpoint from my Angular development server, I consistently get 401 unauthorized. I use Angular's proxy to access cross-domain endpoints for Cognito to authenticate, hitting Lambda endpoints among other things and never have a problem, but I cannot get this to work with this Spring Boot endpoint. I don't think this is a Secrets Manager or even an AWS issue after a long call with AWS Support.

Spring endpoint (I'm very new to Java, so this could require specific headers maybe?):

@GetMapping("/REST/getSecret")
    public String getSecret(@RequestParam String name) {
        String secretName = getSecretByName(name);

        JsonParser parser = new JsonParser();
        Object secretObj = parser.parse(secretName);
        JsonObject secretKeys = (JsonObject) secretObj;

        return secretKeys.toString();
}

Angular service to retrieve secret:

getSecret(secretName: String): Observable<any> {
    const headers = new HttpHeaders({
      'Content-Type': 'application/json',
      'Cache-Control': 'public' // likely unecessary, was trying to make sure cache was clearing at the time
    });
    return this.http.get<any>(
      // this.secretConfig.getSecretUrl() + `/getSecret?name=${secretName}`, // Live Site
      this.secretConfig.getSecretUrl() + `/getSecret/${secretName}`, // Dev
      {
        headers: headers
      }
    ).pipe(map(secret => JSON.parse(secret)));
  }

The Live Site comment is just showing what works while the whole thing is hosted

Angular Proxy:

"/getSecret": {
    "target": "https://websiteurl.com/REST/getSecret?name=",
    "secure": false,
    "logLevel": "debug",
    "changeOrigin": true
  }

The proxy configuration looks funny but this is exactly how I have it setup to run a search with a parameter via a Lambda function and that works as expected.

My only guess at this point is there are specific headers that I may need to setup on my REST endpoint and when trying to pull the data in via the Angular HTTP call? If it is a headers issue, then I could probably test everything locally with Spring Boot running on 8080 and Angular on 4200. Currently the same errors happen when both instances are run locally.

Any help is much appreciated!

Answer 1

I was able to get this to work by adding a @CrossOrigin annotation to the endpoint and opening up some security settings on local via applications.properties file. New to Java and Spring, so very unfamiliar with how the framework works.

@CrossOrigin(origins = "*", allowHeaders = "*")
@GetMapping("/REST/getSecret")