title: How to fix 401 error when the credentials work on one end but not the other
body: <p>When I try to log in the angular portion of my app I get a 401 error but the credentials work in the spring portion. No matter what I try I can't seem to fix it. I was following this <a href="https://www.youtube.com/watch?v=QV7ke4a7Lvc&amp;t=11s" rel="nofollow noreferrer">tutorial</a></p>
  <p>Header</p>
  <pre><code>Request URL: http://localhost:8080/
  Request Method: GET
  Status Code: 401 
  Remote Address: [::1]:8080
  Referrer Policy: strict-origin-when-cross-origin
  Access-Control-Allow-Headers: access_token, authorization, content-type
  Access-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE
  Access-Control-Allow-Origin: *
  Access-Control-Max-Age: 4200
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Connection: keep-alive
  Content-Length: 0
  Date: Sat, 18 Sep 2021 16:40:45 GMT
  Expires: 0
  Keep-Alive: timeout=60
  Pragma: no-cache
  Vary: Origin
  Vary: Access-Control-Request-Method
  Vary: Access-Control-Request-Headers
  WWW-Authenticate: Basic realm=&quot;Realm&quot;
  WWW-Authenticate: Basic realm=&quot;Realm&quot;
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  </code></pre>
  <p>Spring Security config This portion works well enough to allow me to sign into the spring server.</p>
  <pre><code>    @Configuration
  public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
  
  
      @Autowired
      private CorsConfiguration myCorsFilter;
  
      @Override
      public void configure(WebSecurity web) throws Exception
      {
          // Allow Login API to be accessed without authentication
          web.ignoring().antMatchers(&quot;/login&quot;).antMatchers(HttpMethod.OPTIONS, &quot;/**&quot;); // Request type options should be allowed.
      }
  
  //CORS
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
       /*   http.cors().and().csrf().
                  disable()
                  .authorizeRequests()
                  .antMatchers(HttpMethod.OPTIONS, &quot;/**&quot;)
                  .permitAll()
                  .anyRequest()
                  .fullyAuthenticated()
                  .and()
                  .httpBasic();*/
  
          http.addFilterBefore(myCorsFilter, ChannelProcessingFilter.class);
  
  
          http.cors();
          http.csrf().disable();
          http.authorizeRequests().antMatchers(&quot;/**&quot;).fullyAuthenticated().and()
                  .httpBasic();
      }
  
  
  
      protected void configure(AuthenticationManagerBuilder auth) throws Exception{
          auth.inMemoryAuthentication()
                  .withUser(&quot;dave&quot;)
                  .password(&quot;{noop}dave&quot;).roles(&quot;USER&quot;);
  
  
      }
  }
  </code></pre>
  <p>CorsFilter</p>
  <pre><code>@Component
  @Order(Ordered.HIGHEST_PRECEDENCE)
  public class CorsConfiguration implements Filter {
  
      /**
       * CORS filter for http-request and response
       */
      public void CORSFilter() {
      }
  
      /**
       * Do Filter on every http-request.
       */
  
      @Override
      public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
          HttpServletResponse response = (HttpServletResponse) res;
          HttpServletRequest request = (HttpServletRequest) req;
          response.setHeader(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
          response.setHeader(&quot;Access-Control-Allow-Methods&quot;, &quot;POST, PUT, GET, OPTIONS, DELETE&quot;);
          response.setHeader(&quot;Access-Control-Max-Age&quot;, &quot;4200&quot;);
          response.setHeader(&quot;Access-Control-Allow-Headers&quot;, &quot;access_token, authorization, content-type&quot;);
  
          if (&quot;OPTIONS&quot;.equalsIgnoreCase(request.getMethod())) {
              response.setStatus(HttpServletResponse.SC_OK);
          } else {
              chain.doFilter(req, res);
          }
      }
  
      /**
       * Destroy method
       */
      @Override
      public void destroy() {
      }
  
      /**
       * Initialize CORS filter
       */
      @Override
      public void init(FilterConfig arg0) throws ServletException {
      }
  }
  </code></pre>