Styjun

I am developing an application with angular 6 as front end and spring boot as back end. Currently I am working with forgot password functionality :

1. Taking email id from angular and sending an email to the id.

@RequestMapping(value = "/forgotPassword", method = RequestMethod.POST)
public ResponseEntity<?> forgotPassword(@RequestParam("email") String recepientemail, HttpServletRequest request) 
 Optional<User> userlist = userRepository.findByEmail(recepientemail);
 SimpleDateFormat simpleDateFormat = new SimpleDateFormat("yyyy-MM-dd hh:mm:ss");
 if (userlist.isPresent()) 
 User u = userlist.get();
 u.setResetToken(UUID.randomUUID().toString()); 
 u.setResetTokenExpiry(simpleDateFormat.format(DateUtils.addDays(new Date(), 1)));
 u.setModifiedBy(u.getId());
 u.setModifiedDate(simpleDateFormat.format(new Date()));
 userRepository.save(u);
 String appUrl = request.getScheme() + "://" + request.getServerName() + ":" + request.getLocalPort();

 // Email message
 email.sendSimpleEmail(u.getEmail(), "DIS Password Reset Request",
 "To reset your password, click the link below:n" + appUrl + "/dis/resetPassword?resetToken="
 + u.getResetToken());
 return new ResponseEntity<>(
 new ResponseMessage("A password reset link has been sent to registered email address!"),
 HttpStatus.OK);
 
 return new ResponseEntity<>(new ResponseMessage("We didn't find an account for this e-mail address!"),
 HttpStatus.BAD_REQUEST);
 

2. By clicking on link spring boot will redirect to the angular's reset password page.

@RequestMapping(value = "/resetPassword", method = RequestMethod.GET)
 public ModelAndView displayResetPasswordPage(@RequestParam("resetToken") String token) throws ParseException 
 SimpleDateFormat simpleDateFormat = new SimpleDateFormat("yyyy-MM-dd hh:mm:ss");
 Optional<User> user = userRepository.findUserByResetToken(token);
 ModelAndView modelAndView = new ModelAndView();
 if (user.isPresent()) // Token found in DB
 if (simpleDateFormat.parse(user.get().getResetTokenExpiry()).after(new Date())) 
 modelAndView.addObject("resetToken", token);
 modelAndView.setViewName("redirect:http://localhost:4200/reset-password");
 else 
 modelAndView.addObject("errorMessage", "Oops! Your password reset link has expired.");
 modelAndView.setViewName("redirect:http://localhost:4200/forgot-password");
 
 else // Token not found in DB
 modelAndView.addObject("errorMessage", "Oops! This is an invalid password reset link.");
 modelAndView.setViewName("redirect:http://localhost:4200/forgot-password");
 
 return modelAndView;
 

3. By entering the new password on reset page, angular will pass the reset token and new password to spring boot and then spring boot should redirect to login page after successful change of password.

@RequestMapping(value = "/processResetPassword", method = RequestMethod.POST)
 public ModelAndView setNewPassword(@RequestBody Map<String, String> requestParams, RedirectAttributes redir, HttpServletResponse response) 
 SimpleDateFormat simpleDateFormat = new SimpleDateFormat("yyyy-MM-dd hh:mm:ss");
 Optional<User> user = userRepository.findUserByResetToken(requestParams.get("resetToken"));
 ModelAndView modelAndView = new ModelAndView();
 if (user.isPresent()) 
 User resetUser = user.get();
 resetUser.setPassword(encoder.encode(requestParams.get("password")));
 resetUser.setResetToken(null);
 resetUser.setResetTokenExpiry(null);
 resetUser.setModifiedBy(resetUser.getId());
 resetUser.setModifiedDate(simpleDateFormat.format(new Date()));
 userRepository.save(resetUser);
 //redir.addFlashAttribute("successMessage", "You have successfully reset your password. You may now login.");
 //modelAndView.addObject("successMessage", "You have successfully reset your password. You may now login.");
 modelAndView.setViewName("redirect:http://localhost:4200");
 return modelAndView;
 else 
 modelAndView.addObject("errorMessage", "Oops! This is an invalid password reset link.");
 modelAndView.setViewName("redirect:http://localhost:4200/forgot-password");
 
 return modelAndView;
 

Now the problem is, in second point spring boot is able to redirect the reset password page perfectly but in third point while redirecting to login page it is giving CORS error. Why?

Here is the screenshot of error

Edit:
Here is cross origin annotation

@CrossOrigin(origins = "*", maxAge = 3600)
@RestController
@RequestMapping("/dis")
public class AuthRestAPIs ....

and here is the request header at network