title: Spring Security Oauth2 Swagger
body: <p>I am attempting to configure Swagger Authentication on my resource server, so that I can authenticate against my authorization server. </p>
  
  <p>I have the resource and authorization servers separated. They are both starting up on my localhost with different ports.</p>
  
  <ul>
  <li>Resource Server on port 8083</li>
  <li>Authorization Server on port 8081</li>
  </ul>
  
  <p>Whenever I attempt to "Authorize", there is a CORS issues.</p>
  
  <p>I forked a project from another website to use as my testing grounds. Below is the forked project.</p>
  
  <p><a href="https://github.com/cbriarnold/oauth2-spring-boot-2.0.2" rel="nofollow noreferrer">https://github.com/cbriarnold/oauth2-spring-boot-2.0.2</a></p>
  
  <p>To test, once both the authorization server and resource server are started, do the following:</p>
  
  <ol>
  <li>Go to <a href="http://localhost:8083/swagger-ui.html" rel="nofollow noreferrer">http://localhost:8083/swagger-ui.html</a></li>
  <li>Click on "Authorize" button</li>
  <li>Click on "Authorize" button in dialog</li>
  </ol>
  
  <p>If you have the developer tools open, you will see that there is the CORS error </p>
  
  <blockquote>
    <p>Access to fetch at '<a href="http://localhost:8081/oauth/token/" rel="nofollow noreferrer">http://localhost:8081/oauth/token/</a>' from origin '<a href="http://localhost:8083" rel="nofollow noreferrer">http://localhost:8083</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.</p>
  </blockquote>
  
  <p>The http status code associated with the above CORS error was 302.</p>
  
  <p>So, I modify the source to try to permitAll (I know this is undesired from a security perspective, but I am just trying to figure out what is going on). I will receive the same CORS error, but with the https status code of 403. Code is found on the following branch.</p>
  
  <p><a href="https://github.com/cbriarnold/oauth2-spring-boot-2.0.2/tree/permitAll" rel="nofollow noreferrer">https://github.com/cbriarnold/oauth2-spring-boot-2.0.2/tree/permitAll</a></p>
  
  <p>Any suggestions?</p>