Angular + springboot +PKCE redirectUris issue for code retrieval

I have angular as frontend, springboot as backend server implement with spring authorization server for PKCE implementation. I am having issue in redirect_uris to work when the final build is deployed on tomcat. I am using useHash strategy in angular routes. when I add '#' in redirect_uris :http://localhost:8080/#/auth-callback , authorize request to retrieve code is failed with 200 response status, but not code redirection happens.please help with fix for this.

1. I tried adding '#' character in redirect_uris
2. no issue in the dev setting, but issue after deploying the build on Tomcat to simulate prod.

SecurityConfig.java


@Configuration
@EnableWebSecurity
public class SecurityConfig {

@Value("${base_url}")
private String baseUrl;

@Bean
PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}

@Bean
@Order(1)
SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class).oidc(Customizer.withDefaults());

http.cors(cors -> cors.configurationSource(new CorsConfigurationSource() {
@Override
public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOriginPattern("*");
config.addAllowedHeader("*");
config.addAllowedMethod("*");
config.addExposedHeader("Authorization");
config.setMaxAge(366000L);
return config;

}
})).exceptionHandling((exceptions) -> exceptions.defaultAuthenticationEntryPointFor(
new LoginUrlAuthenticationEntryPoint("/login"), new MediaTypeRequestMatcher(MediaType.TEXT_HTML)));

return http.build();
}

@Bean
@Order(2)
SecurityFilterChain jwtFilterChain(HttpSecurity http) throws Exception {
http.securityMatcher("/api/**")
.authorizeHttpRequests((authorize) -> authorize
.requestMatchers("/api/test/unprotected", "/api/notices", "/api/contact").permitAll()
.anyRequest().authenticated())
.sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.oauth2ResourceServer((resourceServer) -> resourceServer.opaqueToken(Customizer.withDefaults()))
.csrf(AbstractHttpConfigurer::disable);

return http.build();
}

@Bean
@Order(3)
SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests((authorize) -> authorize
.requestMatchers("/", "/index.html", "/static/**", "/assets/**", "/favicon.ico", "/images/**", "/*.ttf", // Allow
// in
// subdirectories
"/*.woff", "/*.woff2", "/*.eot", "/*.svg", "/v3/api-docs/**", "/swagger-ui/**",
"/swagger-ui.html", "/*.js", "/*.css", // Root-level CSS and JS
"/v3/api-docs/**", "/swagger-ui/**", "/swagger-ui.html")
.permitAll().anyRequest().authenticated()).formLogin(Customizer.withDefaults())
.logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(customLogoutSuccessHandler()))
.httpBasic(Customizer.withDefaults()).csrf(AbstractHttpConfigurer::disable);

return http.build();
}

@Bean
LogoutSuccessHandler customLogoutSuccessHandler() {
return (request, response, authentication) -> {
response.sendRedirect(baseUrl);
};
}

}


oauth2_registered_client table:

id client_id client_id_issued_at client_secret client_secret_expires_at client_name client_authentication_methods authorization_grant_types redirect_uris scopes client_settings token_settings

1 oidc-client 09-08-2024 08:33 $2a$10$gqwXtRsO8JStQpT1gV2SYOC8IEHREA6lWs/KoHGeVGIqO6CaURVda NULL OIDC Client client_secret_basic authorization_code http://localhost:8080/#/ openid {"requireAuthorizationConsent":false,"requireProofKey":true} "{""accessTokenFormat"":""REFERENCE"",

""accessTokenTimeToLive"":""PT30M"",

""refreshTokenTimeToLive"":""P30D"",

""reuseRefreshTokens"":true}"
​

application.yml

spring:
profiles:
active: prod
application:
name: eazybank
datasource:
url: jdbcostgresql://localhost:5432/eazybank
username: postgres
password: saral001
driver-class-name : org.postgresql.Driver
jpa:
database-platform : org.hibernate.dialect.PostgreSQLDialect
show-sql: false
properties:
hibernate:
format_sql: true
security:
oauth2:
resourceserver:
opaque-token:
introspection-uri: http://localhost:8080/oauth2/introspect
client-id: oidc-client # Client ID for introspection
client-secret: password # Client Secret for introspection
servlet:
multipart:
max-file-size: 200MB
max-request-size: 200MB

springdoc:
enable-spring-security: true
show-login-endpoint: true
show-oauth2-endpoints: true

#logginglevel.org.springframework.security=DEBUG
logging:
level:
org:
springframework:
security: TRACE
pattern:
console: "%file - %m%n"


server:
tomcat:
max-post-size: 209715200 # 200 MB

Continue reading...