Проблема с весенней загрузкой AWS CORS ⇐ JAVA

[Anonymous]

У меня есть приложение Reactjs, развернутое в AWS Amplify и размещенное по URL-адресу: https://example.com.
У меня есть приложение Spring Boot, развернутое в экземпляре EC2 и доступ к которому осуществляется с сервера NGINX. с api.example.com.
reactjs взаимодействует с серверной частью, используя https://api.example.com/...
Когда я запускался в Chrome с отключением безопасности (CORS также отключен), он может получать данные.
Но в обычном Chrome / Mozilla выдает ошибку CORS.
Я добавил CORS при весенней загрузке настроить как:
@Bean
public CorsFilter corsFilter() throws Exception{
CorsConfiguration config = new CorsConfiguration();
config.setAllowedOriginPatterns(List.of("*")); // Allow all origins
config.addAllowedHeader("*");
config.addAllowedMethod("*");
config.setAllowCredentials(true);

config.addExposedHeader("code");
config.addExposedHeader("reason");

UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();

source.registerCorsConfiguration("/**", config);
log.info(new ObjectMapper().writeValueAsString(config));
return new CorsFilter(source);
}

Также после долгих поисков я добавил конфигурацию в vi /etc/nginx/sites-available/api.example.com как
upstream backend-service-api.example.com {
server localhost:8080;
#server search - service - 3: 8082;
}

server {

server_name api.example.com;

location /{
proxy_pass https://example.com;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;

}

location ~* "^/api/backapp-service(/|$)(.*)" {
rewrite "(?i)/api/backapp-service(/|$)(.*)" /$2 break;

# Handle preflight requests
if ($request_method = 'OPTIONS') {
add_header 'Access-Control-Allow-Origin' 'https://example.com';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization';
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Content-Length' 0;
add_header 'Content-Type' 'text/plain';
return 204;
return 204;
}

# Handle actual requests
add_header 'Access-Control-Allow-Origin' 'https://example.com';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization';
add_header 'Access-Control-Allow-Credentials' 'true';

proxy_pass http://backend-service-api.example.com;
}
location ~* "^/media(/|$)(.*)" {
rewrite "(?i)/media(/|$)(.*)" /$2 break;
root /home/ubuntu/PRODUCTION/FileServer;
}

error_page 401 = @error401;
location @error401 {
add_header 'Access-Control-Allow-Origin' 'https://example.com';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization';
add_header 'Access-Control-Allow-Credentials' 'true';
return 401;
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/api.example.com-0001/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/api.example.com-0001/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
if ($host = api.example.com) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
listen [::]:80;

server_name api.example.com;
return 404; # managed by Certbot

}

но все равно проблема с CORS. Нужны ваши предложения.
когда Curl -I -X ОПЦИИ https://api.example.com/api/backapp-ser ... tзаголовок ответа
HTTP/1.1 200
Server: nginx/1.24.0 (Ubuntu)
Date: Wed, 30 Oct 2024 15:19:09 GMT
Content-Length: 0
Connection: keep-alive
reason: Invalid JWT token::CharSequence cannot be null or empty.
code: 401
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Allow: GET,HEAD,POST,OPTIONS
Accept-Patch:
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Origin, Content-Type, Accept, Authorization
Access-Control-Allow-Credentials: true


Подробнее здесь: https://stackoverflow.com/questions/791 ... cors-issue