My server works on localhost and my VPN address (26.185.15.150), when I make request to http://localhost:3500/login/auth, I get correctly response and cookies. When I make request to http://26.185.15.150:3500/login/auth, I don't get cookies, but I get "set-cookies" in headers, how I need fix that? SecurityConfig
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf(AbstractHttpConfigurer::disable)
.authorizeHttpRequests(authorizeRequests ->
authorizeRequests
.requestMatchers("/login/**", "/v3/**", "/swagger-resources/**", "/swagger-ui.html", "/webjars/**", "/swagger-ui/**").permitAll()
.requestMatchers("/image/**").permitAll()
.requestMatchers("/api/unsecured").permitAll()
.requestMatchers("/api/secured").hasAnyRole("2001", "5320")
.requestMatchers("/api/admin").hasRole("5320")
.requestMatchers("/api/info").authenticated()
)
.sessionManagement(c -> c.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.exceptionHandling(c -> c.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)))
.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
return http.build();
}
@Bean
public CorsFilter corsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOrigin("http://localhost:5173");
config.addAllowedOrigin("*");
config.addAllowedHeader("Content-Type");
config.addAllowedHeader("Authorization");
config.addAllowedMethod("GET");
config.addAllowedMethod("POST");
config.addAllowedMethod("PUT");
config.addAllowedMethod("DELETE");
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);
}
my cookies set-up
public void setTokenCookies(HttpServletResponse response, JwtResponse jwtResponse) {
Cookie refreshTokenCookie = new Cookie("jwt", jwtResponse.getJwtRefreshToken());
refreshTokenCookie.setHttpOnly(true);
refreshTokenCookie.setMaxAge((int) jwtRefreshTokenLifetime.toHours());
refreshTokenCookie.setSecure(true);
refreshTokenCookie.setPath("/");
response.addCookie(refreshTokenCookie);
}
I excpected that my http request will correctly work with ip-address, like a localhost.