I am trying to configure auth0 as an external login service. From the server side everything seems to be correctly set up as I can use the server throught the browser and the login redirect is working correctly and I can get the PRINCIPAL in the endpoints to check the user info.

However, when I try to link my front end application I keep getting CORS issues that I have tried for several weeks to solve but have been unable. From the backend I added a CORSFILTER that already is adding the correct headers to the reply:

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class MyCORSFilter implements Filter {

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
        throws IOException, ServletException {

    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
    response.setHeader("Access-Control-Allow-Credentials", "true");
    response.setHeader("Access-Control-Allow-Methods", "POST, GET, DELETE");
    response.setHeader("Access-Control-Max-Age", "3600");
    response.setHeader("Access-Control-Allow-Headers",
            "Content-Type, Accept, X-Requested-With, remember-me");
    chain.doFilter(req, res);
}

@Override
public void init(FilterConfig filterConfig) {
}

@Override
public void destroy() {
}
}

With this I can already see the redirect occuring to my auth0 page but is having the following CORS error:

the error 302 is occuring and I am not able to fix it.

I have added the front end applicaiton to the auth0 configurations (in both Allowed Web Origins and Allowed Origins (CORS))

My questions:

1 – Is there any config missing from my server that I still need to add?
2 – Is there something missing in the front end applicaiton to handle redirects that I need to include in order to be able to fix this?

I have checked several posts and tried different things but nothing seems to be working. I am not using the @EnableWebSecurity as this bypasses the auth0 authentication and uses the default spring one.

Any advice?