Spring Security with Angular - OAuth 2.0 login REST style

My Angular application is deployed to localhost:4200 and Spring application is in localhost:8080. I am trying to implement OAuth2 security in purely REST style so entirely @RestController. All examples I saw requires returning a view which is discouraged.

Below is the intended flow :

1)My Angular button hits the : http://localhost:8080/OAuthTrial/api/oauth-login

2)It should redirect to the Google Auth screen(I am trying to make Google work so I can translate to our custom OAuth server)

3)User authenticates and it hits back the callback endpoint in the Spring application and gets the "code"

4)The Spring application exchanges the "code" for access token and the access token for a JWT which it should send back to the Angular application

5)All the API endpoints must be secured with the JWT, which will be requested by the Angular application with the received JWT. The Spring application verifies the JWT with the Auth server.

I have trying to make this work through Spring Security filter chain settings but wasn't able to. All examples involve returning a view. I am trying to not do that.

So my requirements are :

1)How to configure this in Spring Security. I tried doing this manually(making HTTPS requests to Google Auth server) and I get all the responses as expected but making the variables be available globally, Authentication setting etc. I see I have to do that manually also. So I figured I would use the standard implementation.

2)When I tried changing the Http "Location" header in my "oauth-login" endpoint, I getting the following error :

Access to XMLHttpRequest at 'https://accounts.google.com/o/oauth2/v2/auth
(redirected from 'http://localhost:8080/GoogleOpenId/api/login') from origin 'http://localhost:4200'
has been blocked by CORS policy:
No 'Access-Control-Allow-Origin' header is present on the requested resource.


Anyway to alleviate

3)Is this flow impossible. I am trying to avoid Implicit flow. And as I was informed Authorization Code with PKCE is not supported for SPA websites here. So I trying to make this work with Authorization Code where my Spring application is the OAuth Client and also a Resource Server.

If the community could provide SecurityConfigs and any other configs and any relevant knowledge, it would be much appreciated.

Thanks in advance

Continue reading...