Response for preflight has invalid HTTP status code 401 - Spring

Question

everyone. I'm new to Angular 2 and Spring Framework. I'm trying a simple get request with an authorization header (basic auth).

I'm using Spring Boot (1.2.6.RELEASE), which can also be relevant. My CORS configuration looks like this.

@Component
public class SimpleCorsFilter implements Filter {

private final Logger log = LoggerFactory.getLogger(SimpleCorsFilter.class);

public SimpleCorsFilter() {
    log.info("SimpleCORSFilter init");
}

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;

    response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
    response.setHeader("Access-Control-Allow-Credentials", "true");
    response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
    response.setHeader("Access-Control-Max-Age", "3600");
    response.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me, authorization, x-auth-token");

    chain.doFilter(req, res);
}

@Override
public void init(FilterConfig filterConfig) {
}

@Override
public void destroy() {
}

}

And here's what it looks like from the client side

    this.headers.append('Authorization', 'Basic dXNlcjphZG1pbg==');
    return this.http
            .get(`http://localhost:8080/api/login?username=${username}`, {headers : this.headers} )
            .map(response => response.json().data as any);
}

I keep getting:

XMLHttpRequest cannot load http://localhost:8080/api/login?username=user. Response for preflight has invalid HTTP status code 401

Please help, i don't know what i'm missing... I checked around a lot of posts already but couldn't get there...

HTTP 401 means your request can't be fulfilled because of missing authorization, check if is working — Ammar
– Ammar, Commented Nov 2, 2016 at 5:11
Can you remove the response.setHeader("Access-Control-Allow-Credentials", "true"); and try out ? — Tharsan Sivakumar
– Tharsan Sivakumar, Commented Nov 2, 2016 at 10:12

kvk95 · Accepted Answer · 2018-03-15 05:12:41Z

11

This could be very late but this could solve some ones problem, after long hours i found the answer

public class SecurityConfig extends WebSecurityConfigurerAdapter
{
    @Override
    public void configure( WebSecurity web ) throws Exception
    {
        web.ignoring().antMatchers( HttpMethod.OPTIONS, "/**" );
    }
}

Refer https://stackoverflow.com/a/45830981/3724760

answered Mar 15, 2018 at 5:12

kvk95

1482 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

DonieM Over a year ago

This needs to be the top answer - got here after hours and hours of crawling through the Spring docs, github and SO

deniswsrosa Over a year ago

I have spent a few hours until I finally found this answer.

Eswar · Accepted Answer · 2016-11-02 07:30:03Z

9

avoid filtering and set status 200 when http method is OPTIONS

if("OPTIONS".equalsIgnoreCase(request.getMethod())) {
    response.setStatus(HttpServletResponse.SC_OK);
} else {
    chain.doFilter(req, res);
}

answered Nov 2, 2016 at 7:30

Eswar

4,9931 gold badge14 silver badges17 bronze badges

2 Comments

Manuel Zamith Over a year ago

Thanks @Eswar , I'm not getting the error anymore. However, is ignoring the OPTIONS request a good implementation? I'm asking because i really don't know.

Eswar Over a year ago

we can validate request headers and send status code without filter. browser is making preflight request whenever we send Authorization in header, so we are just validating origin and throwing error status code. ignoring OPTIONS will not affect other http methods as we are filtering, but I am unsure that its good implementation or not.

Yogen Rai · Accepted Answer · 2017-09-24 01:21:16Z

6

If there is anyone getting into the similar situation working around with Spring Boot, Spring Security and clients like angular 2/4, I've posted the findings here.

For those who are looking for a short answer, you have to configure two things:

With Spring Boot, the recommended way to enable global CORS is to declare within Spring MVC and combined with fine-grained @CrossOrigin configuration as:

@Configuration
public class CorsConfig {

    @Bean
    public WebMvcConfigurer corsConfigurer() {
        return new WebMvcConfigurerAdapter() {
            @Override
            public void addCorsMappings(CorsRegistry registry) {
                registry.addMapping("/**").allowedMethods("GET", "POST", "PUT", "DELETE").allowedOrigins("*")
                        .allowedHeaders("*");
            }
        };
    }
}

Then, while working with Spring Security, you have to enable CORS at Spring Security level as well to allow it to leverage the configuration defined at Spring MVC level as:

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and()...
    }
}

Cheers!!!

edited Sep 24, 2017 at 1:21

answered Sep 22, 2017 at 20:23

Yogen Rai

3,0214 gold badges27 silver badges39 bronze badges

2 Comments

khelwood Over a year ago

While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review

Yogen Rai Over a year ago

@khelwood updated the answer, but why down voting?? is this something like judging a book by the cover? if i hadn't had updated the answer, i would have appreciated.

Collectives™ on Stack Overflow

Response for preflight has invalid HTTP status code 401 - Spring

3 Answers 3

2 Comments

2 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related