<spring boot>请求的资源上不存在“Access-Control-Allow-Origin”header</spring>

Question

I am starting to lose my mind here. My project is ran on Spring boot and React, I am trying to implement a logout functionality. I want to make this work:

1. User is logged in
2. User clicks on Log out
3. The JWT token cookie gets deleted, user gets redirected to localhost:3000

From react app (localhost:3000), i want to call the "/exit" endpoint on Spring Boot server (localhost:8080/exit). There are no other issues with cors apart from this with my implementation (no errors when fetching data from the server, logging in or registering a user).

Here is the code (Spring Boot):

(UserController.java)

    @RequestMapping("/exit")
    public void exit(HttpServletRequest request, HttpServletResponse response) {
        // token can be revoked here if needed
        new SecurityContextLogoutHandler().logout(request, null, null);
        try {
            //sending back to client app
            response.sendRedirect(request.getHeader("referer"));
            System.out.println("called logout endpoint");
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

(SecurityConfig.java)

 @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors();
        http.csrf().disable();
        http.authorizeRequests();
        http.sessionManagement().sessionCreationPolicy(STATELESS);
        http.authorizeRequests().antMatchers("/login/**", "/register/**").permitAll();
        http.authorizeRequests().antMatchers("/student/**").hasAuthority(Role.STUDENT.getCode());
        http.authorizeRequests().antMatchers("/teacher/**").hasAuthority(Role.TEACHER.getCode());
        http.authorizeRequests().antMatchers("/coordinator/**").hasAnyAuthority(Role.COORDINATOR.getCode(), Role.ADMIN.getCode());
        http.authorizeRequests().antMatchers("/admin/**").hasAuthority(Role.ADMIN.getCode());
        http.authorizeRequests().antMatchers("/exit").permitAll();
        http.authorizeRequests().anyRequest().authenticated();
        http
                .logout()
                .logoutUrl("/exit")
                .deleteCookies("access_token")
                .logoutSuccessUrl("http://localhost:3000");
        http.addFilter(new CustomAuthenticationFilter(authenticationManagerBean(), jwtAlgorithm(), userRepository));
        http.addFilterBefore(new CustomAuthorizationFilter(userDetailsService, jwtAlgorithm()), UsernamePasswordAuthenticationFilter.class);
    }

(SecurityConfig.java)

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        final CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(List.of("http://localhost:3000/", "http://localhost:3000"));
        configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "PUT", "OPTIONS", "PATCH", "DELETE"));
        configuration.setAllowedHeaders(List.of("Authorization", "Cache-Control", "Content-Type", "Access-Control-Allow-Origin"));
        configuration.setAllowCredentials(true);
        configuration.setExposedHeaders(List.of("Authorization", "Access-Control-Allow-Origin"));
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

All I want is to get rid of the damn

Access to XMLHttpRequest at 'http://localhost:3000/' (redirected from 'http://localhost:8080/exit') from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

error. Without essentially turning the cors completely off.

I've looked over most posts here asking similar questions, I haven't found the answer. Nothing worked yet. The error remains the same.

Can you please help me? Thank you.

Answer 1

It has to be related to response.sendRedirect line. With this command, it is as if you have sent a request to the client side, from the server side. So the CORS policy comes into play again. I have no experience with React, but I think you need to configure the WebServer on which the React application is running. Or, instead of sendRedirect, you can return 200 OK and do this redirect on the client side.