title: Angular/Spring Boot with Keycloak throws 403
body: <p>I secured my Spring Boot application with Keycloak 11.0.2 and Spring Security following <a href="https://www.baeldung.com/spring-boot-keycloak" rel="nofollow noreferrer">this documentation</a>.</p>
  <p>I used the basic Keycloak configuration in <code>application.properties</code>:</p>
  <pre class="lang-yaml prettyprint-override"><code>    keycloak.auth-server-url=http://localhost:8085/auth
      keycloak.realm=cirta
      keycloak.resource=cirta-api
      keycloak.public-client=false
  </code></pre>
  <p>I have a separate frontend Angular app, that is configured as a different client in Keylocak; but in the same realm as the Spring Boot app. From the Angular app I am sending the Keycloak-provided token in the HTTP headers with:</p>
  <pre><code>'Authorization' : 'Bearer ' + this.securityService.kc.token
  </code></pre>
  <p>When I access an Angular page that calls a <code>GET</code> API, I get a <code>blocked by CORS policy</code> error:</p>
  <pre><code>Access to XMLHttpRequest at 'http://localhost:8080/api/modePaiements' from origin 'http://localhost:4200' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.
  </code></pre>
  <p>So I've tried adding the <code>keycloak.cors=true</code> property to <code>application.properties</code>. With that property added, the <code>GET</code> calls are working. But now when I call a <code>POST/PUT</code> API I'm getting a <code>Failed to load resource: the server responded with a status of 403 ()</code> error.</p>
  <p><strong>KeycloakWebSecurityConfigurerAdapter:</strong></p>
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      super.configure(http);
      http.authorizeRequests().antMatchers(&quot;/api/*&quot;).hasRole(&quot;app-manager&quot;).anyRequest().permitAll();
  }
  </code></pre>
  <p><strong>Spring Sample Application :</strong> <a href="https://github.com/bilaldekar/kc" rel="nofollow noreferrer">https://github.com/bilaldekar/kc</a></p>
  <p><strong>Angular Sample Application :</strong> <a href="https://github.com/bilaldekar/kc-ang" rel="nofollow noreferrer">https://github.com/bilaldekar/kc-ang</a></p>
  <p><strong>Request Headers:</strong></p>
  <p><a href="https://i.stack.imgur.com/XAXwU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XAXwU.png" alt="enter image description here" /></a></p>