# How to provide unauthenticated route

**URL:** <https://devforum.okta.com/t/how-to-provide-unauthenticated-route/22269>\
**Category:** OAuth/OIDC\
**Tags:** api, java, reactjs\
**Created:** [October 27, 2022, 3:08pm UTC](https://devforum.okta.com/t/how-to-provide-unauthenticated-route/22269 "2022-10-27T15:08:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mnibras](https://avatars.discourse-cdn.com/v4/letter/m/47e85d/32.png) [@mnibras](https://devforum.okta.com/u/mnibras)\
**Post date:** [October 27, 2022, 3:08pm UTC](https://devforum.okta.com/t/how-to-provide-unauthenticated-route/22269/1 "2022-10-27T15:08:04Z")

</div>

I’m developing Springboot and React web application secured by Okta. All the react web pages are now behind Okta security.  
Now I want a public web page ([https://my.example.com/welcome](https://my.example.com/welcome)) that all the users can visit regardless of security. I have permitted the route in the Spring security config. When I visit to /welcome route, the browser is giving below warning message and web page is blank

```auto
Cross-Origin Read Blocking (CORB) blocked cross-origin response https://xxxxxxx.okta.com/oauth2/default/v1/authorize?response_type=code&client_id=xxxxxxxxx&scope=profile%20email%20openid&state=rDYLqV7WDv2la1onSvQsTNeXCvDmWhS0_ZoPFlMAE80%3D&redirect_uri=https://xxxxxx.xxxxx.com/careportal/login/callback&nonce=XvMoC5iP5OGYsvG0bS-QfQh1yfYmhNohmD7GvfukyCo with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.

```

How can I provide access to the /welcome page without authentication?

```auto
okta:
  oauth2:
    issuer: https://xxxxxxxxx.okta.com/oauth2/default
    clientId: xxxxxxxxxxxxxx
    clientSecret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    post-logout-redirect-uri: /
    redirect-uri: /login/callback

```

```auto
httpSecurity.authorizeRequests()
                .antMatchers("/", "/welcome").permitAll()
                .anyRequest().authenticated()
                .and().logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .and().oauth2Client()
                .and().oauth2Login();
        return httpSecurity.build();

```

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [October 27, 2022, 7:03pm UTC](https://devforum.okta.com/t/how-to-provide-unauthenticated-route/22269/2 "2022-10-27T19:03:56Z")

</div>

Does this guide about how to require auth for only specific routes help? [Sign users in to your web app using the redirect model | Okta Developer](https://developer.okta.com/docs/guides/sign-into-web-app-redirect/spring-boot/main/#require-authentication-for-a-specific-route)

---

<div class="post-metadata">

**Author:** ![mnibras](https://avatars.discourse-cdn.com/v4/letter/m/47e85d/32.png) [@mnibras](https://devforum.okta.com/u/mnibras)\
**Post date:** [October 28, 2022, 5:45am UTC](https://devforum.okta.com/t/how-to-provide-unauthenticated-route/22269/3 "2022-10-28T05:45:59Z")

</div>

I have done according to that. But this /welcome route is not rendering. I’m getting this warning in Chrome

```auto
Cross-Origin Read Blocking (CORB) blocked cross-origin response https://xxxxxxx.okta.com/oauth2/default/v1/authorize?response_type=code&client_id=xxxxxxxxx&scope=profile%20email%20openid&state=rDYLqV7WDv2la1onSvQsTNeXCvDmWhS0_ZoPFlMAE80%3D&redirect_uri=https://xxxxxx.xxxxx.com/careportal/login/callback&nonce=XvMoC5iP5OGYsvG0bS-QfQh1yfYmhNohmD7GvfukyCo with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.

```

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [October 31, 2022, 3:29pm UTC](https://devforum.okta.com/t/how-to-provide-unauthenticated-route/22269/4 "2022-10-31T15:29:39Z")

</div>

The /authorize endpoint does not support CORS. You must redirect to this route, as mentioned in [our docs.](https://developer.okta.com/docs/reference/api/oidc/#authorize)

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 13, 2024, 12:25am UTC](https://devforum.okta.com/t/how-to-provide-unauthenticated-route/22269/5 "2024-02-13T00:25:21Z")

</div>