title: https for a (java + angular) dev env on a local network causes CORS
body: <p>I have the following &quot;architecture&quot;:</p>
  <ul>
  <li>a java API / backoffice application on one computer</li>
  <li>an angular client application on another computer</li>
  <li>both are on the same local network for dev env, and both have a static IP</li>
  </ul>
  <p>To test the application, the front application is calling the API using the computer IP: <a href="http://192.168.0.XY:ABCD/api" rel="nofollow noreferrer">http://192.168.0.XY:ABCD/api</a></p>
  <p><em>ABCD = 8080 for http and 8443 for https</em></p>
  <p>All this is working fine as long as I'm having only http on dev env.
  On prod env, https is working fine too.</p>
  <p>Problem context:</p>
  <ul>
  <li>I have to use https for both API/back and client on dev side too</li>
  <li>on server side, the backoffice UI is working with https and I can use the backoffice features (I just have an alert because my certifcate is auto signed)</li>
  <li>on front side, I can see the homepage with https (with the same alert message for the same reason)</li>
  </ul>
  <p>Problem is that when I try to connect on client UI, on dev side with https, it tries to call API, and fall into a CORS error.
  Please note that the API allows both http and https origins:</p>
  <pre><code>@CrossOrigin(origins = { &quot;http://localhost:4200&quot;, &quot;https://localhost:4200&quot;, &quot;https://www.yodo.rip&quot; })
  @RequestMapping(value = &quot;/login&quot;, method = {RequestMethod.OPTIONS, RequestMethod.POST})
  public ResponseEntity&lt;String&gt; authenticate(@RequestBody String authParams) {...}
  </code></pre>
  <p>I spent 2 days on that problem, an hope to find some help here.</p>
  <p><strong>[EDIT]</strong></p>
  <ul>
  <li>on server side, java is using a &quot;.keystore&quot; file, generated with keytool</li>
  <li>on front side, angular is using .crt + .key files generated with openssl</li>
  <li>in the client / API relationship, I don't know who doens't trust the other : client doesn't trust server's certificate ? or server doesn't trust client certificate ?</li>
  </ul>
  <p><strong>[/EDIT]</strong></p>