blacktoviche / springboot-graphql-sqqr-jwt-demo Goto Github PK

no prime_stm_db.sql

Hello, thanks for this excellent example.

I am using your code in my application and I am able to login using postman and insomia, but when I try to login from my client application (vue.js app) I am getting the following error:

Access to fetch at 'http://localhost:9010/graphql' from origin 'http://localhost:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Can you please show me how to configure cors in the server?

Thanks.

Luis

My SecurityConfig file is as follows

@OverRide
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
.csrf().disable()
.authorizeRequests()
.antMatchers("/graphql").permitAll()
.antMatchers("/graphiql").permitAll()
.anyRequest().authenticated();

    JwtFilter authenticationFilter = new JwtFilter(userDetailsService(), jwtTokenUtil);
  httpSecurity.addFilterBefore(authenticationFilter, UsernamePasswordAuthenticationFilter.class);
}

When i execute signin mutation, It also went to filter. Since it does not get any token so its gets blocked. Why is it so?

With this implementation of JwtFilter, all queries/mutations are run through the filter. Wouldn't you need to allow a mutation that can initially create an account in the first place? In this case, the client would not have a JWT token to provide.

If one were to throw an error here when a token was not provided, one could not allow queries/mutations to come through, however, this blocks the ability to create an account/sign in initially.