title: OAuth2 with Google - CORS Error (Angular + Spring boot)
body: <p>I have problem with CORS error. I do request for Google oAuth2 and i get a CORS ERROR: 
  I want to get google authentication and generate a JWT token. When I do it without using the client everything is fine. When I send angular requests this is a problem with CORS. I allow all types of CORS. Why am I getting this error?</p>
  
  <pre><code>Access to XMLHttpRequest at 'https://accounts.google.com/o/oauth2/v2/auth?response_type=code&amp;client_id=1020159669873-d9r35ssmnejud852bam87d8gqtcj5qf1.apps.googleusercontent.com&amp;scope=openid%20profile%20email&amp;state=8nizHP1X2z9sA8m0vqM4Lzd6VT24R15eSw5flteTywM%3D&amp;redirect_uri=http://localhost:8080/oauth2/callback/google' (redirected from 'http://localhost:8080/oauth2/authorization/google')
  from origin 'null' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
  
  Cross-Origin Read Blocking (CORB) blocked cross-origin response https://accounts.google.com/o/oauth2/v2/auth?response_type=code&amp;client_id=1020159669873-d9r35ssmnejud852bam87d8gqtcj5qf1.apps.googleusercontent.com&amp;scope=openid%20profile%20email&amp;state=8nizHP1X2z9sA8m0vqM4Lzd6VT24R15eSw5flteTywM%3D&amp;redirect_uri=http://localhost:8080/oauth2/callback/google with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.
  </code></pre>
  
  <p>My Angular request:</p>
  
  <pre class="lang-js prettyprint-override"><code> googleLogin(): Observable&lt;LoginResponse&gt; {
      return this.http.get&lt;LoginResponse&gt;
      (environment.baseUrl + '/oauth2/authorization/google')
        .pipe(tap(response =&gt; {
          localStorage.setItem('access_token', response.accessToken);
        }));
    }
  
  //...
  
  public onGoogleLogin(): void {
     this.authService.googleLogin().subscribe();
   }
  
  //...
  </code></pre>
  
  <p>CORS CONFIG: </p>
  
  <pre class="lang-java prettyprint-override"><code> @Override
      public void addCorsMappings(CorsRegistry registry) {
          registry
                  .addMapping("/**")
                  .allowedOrigins("*")
                  .allowedMethods("HEAD", "OPTIONS", "GET", "POST", "PUT", "PATCH", "DELETE")
                  .maxAge(MAX_AGE_SECS);
      }
  </code></pre>
  
  <p>Security configuration: </p>
  
  <pre class="lang-java prettyprint-override"><code>   @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .cors()
                      .and()
                  .csrf()
                      .disable()
                  .exceptionHandling()
                      .authenticationEntryPoint(unauthorizedHandler)
                      .and()
                  .sessionManagement()
                      .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                      .and()
                  .authorizeRequests()
                      .antMatchers("/",
                  "/favicon.ico",
                  "/**/*.png",
                  "/**/*.gif",
                  "/**/*.svg",
                  "/**/*.jpg",
                  "/**/*.html",
                  "/**/*.css",
                  "/**/*.js")
                          .permitAll()
                  .antMatchers("/api/v1/oauth0/**")
                          .permitAll()
                  .antMatchers("/api/v1/oauth2/**")
                      .permitAll()
                  .anyRequest()
                      .authenticated()
                      .and()
                  // włączenie obslugi oauth2
                  .oauth2Login()
                  .successHandler(this.successHandler)
                  .redirectionEndpoint()
                      .baseUri("/oauth2/callback/*")
                      .and()
                  .userInfoEndpoint()
                      .oidcUserService(customOidcUserService);
          http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
      }
  </code></pre>
  
  <p>Success Handler: </p>
  
  <pre class="lang-java prettyprint-override"><code>@Autowired
      private UserRepository userRepository;
  
      @Autowired
      private JwtTokenProvider tokenProvider;
  
      private final static String URL = "http://localhost:8080/api/v1/oauth2/authenticate";
  
      @Override
      public void onAuthenticationSuccess(
              HttpServletRequest request,
              HttpServletResponse response,
              Authentication authentication) throws IOException, ServletException {
  
          if (response.isCommitted()) {
              return; }
  
          DefaultOidcUser oidcUser = (DefaultOidcUser) authentication.getPrincipal();
          System.out.println(oidcUser);
          Map attributes = oidcUser.getAttributes();
          String email = attributes.get("email").toString();
          User user = userRepository.findByEmail(email).orElseThrow(
                  () -&gt; new ResourceNotFoundException("User", "email", email)
          );
          String token = tokenProvider.generateToken(user);
          String redirectionUrl = UriComponentsBuilder.fromUriString(URL).queryParam("token", token)
                  .build().toUriString();
          getRedirectStrategy().sendRedirect(request, response, redirectionUrl);
      }
  }
  </code></pre>
  
  <p>Controller: </p>
  
  <pre class="lang-java prettyprint-override"><code>@RestController
  @RequestMapping("/api/v1/oauth2")
  public class OAuth2Controller {
  
      @GetMapping("/authenticate")
      public ResponseEntity&lt;?&gt; authenticateUser(@RequestParam String token) {
          return ResponseEntity.ok(new JwtAuthenticationResponse(token));
      }
  }
  </code></pre>