Nginx – Using OKTA – CORS Error After Upgrading to Spring Boot 3 – CORS header ‘Access-Control-Allow-Origin’ missing

Apparently, your conf allows cross origin requests to /api/myapp/** only and the failing request happens to /oauth2/authorization/okta

Also, instead of:

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http              
                .cors(Customizer.withDefaults())
                .csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests((authz) -> authz
                        .requestMatchers("/actuator/**").permitAll()                      
                        .anyRequest().authenticated())

        ...

        return http.build();
    }

try:

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http, CorsConfigurationSource source) throws Exception {
        http              
                .cors(cors -> cors.configurationSource(source))
                .csrf(configurer -> {
                    final var delegate = new XorCsrfTokenRequestAttributeHandler();
                    delegate.setCsrfRequestAttributeName("_csrf");
                    // Adapted from https://docs.spring.io/spring-security/reference/5.8/migration/servlet/exploits.html#_i_am_using_angularjs_or_another_javascript_framework
                    configurer.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).csrfTokenRequestHandler(delegate::handle);
                    http.addFilterAfter(new CsrfCookieFilter(), BasicAuthenticationFilter.class);
                }).authorizeHttpRequests((authz) -> authz
                        .requestMatchers("/login/**", "/oauth2/**", "/actuator/**").permitAll()                      
                        .anyRequest().authenticated())
                .oauth2Client(Customizer.withDefaults())
                .oauth2Login(Customizer.withDefaults());

        return http.build();
    }

    private static final class CsrfCookieFilter extends OncePerRequestFilter {

        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
                throws ServletException,
                IOException {
            CsrfToken csrfToken = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
            // Render the token value to a cookie by causing the deferred token to be loaded
            csrfToken.getToken();

            filterChain.doFilter(request, response);
        }

    }

this will:

• pick the corsConfigurationSource bean you already defined and explicitly inject it in your security filter-chain
• enable protection against CSRF attacks
• allow anonymous access to the URIs used during the login process (so, before the user is successfully authenticated)

With this modified CORS configuration source @Bean:

@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(List.of("http://localhost:7800"));
    configuration.setAllowedMethods(List.of("*"));
    configuration.setAllowCredentials(true);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/api/myapp/**", configuration);
    source.registerCorsConfiguration("/oauth2/**", configuration);
    source.registerCorsConfiguration("/logout", configuration);
    return source;
}

This will:

• allow HEAD and OPTIONS requests too (and make your intentions clearer, probably).
• allow CORS requests to some missing path
• enable user credentials are support

P.S. n°1

Seems that you forgot to permitAll() access to /login/** and /oauth2/** which are used during the login process.

P.S. n°2

OAuth2 clients with oauth2Login must be protected against CSRF attacks: requests authorization is based on sessions which are the vector for CSRF attacks. Do not disable CSRF.

P.S. n°3

If you were using spring-cloud-gateway in front of both your Vue.js app and your Spring API, all requests would have the same origin: the gateway => no more CORS config needed.

The other benefit would be that you could configure the REST API as a stateless resource server (with CSRF protection disabled) while still using a "confidential" OAuth2 client and keep tokens on your servers only. I have a tutorial for configuring spring-cloud-gateway as such a BFF there. The frontend is written with Angular, but as all that is required regarding authorization is setting window.location.href, you should be able to port it to Vue.

This makes me strongly recommand you do introduce a BFF between your Vue.js app and your REST API:

• use spring-cloud-gateway as stateful OAuth2 client with login and CSRF protection and TokenRelay filter
• switch your REST API to resource server configuration (stateless and disabled CSRF)

The layer with sessions will be thinner and your overall architecture will scale much better.