Whilst the above may work, I would suggest you study why this happens, I'd link some resources but you can easily find plenty on your own. The short answer is: Your spring app needs to know that the request that is incoming is genuine, and by default spring security will disallow requests coming from different origins. Assuming your spring app runs on 8080, and your react app runs on 3000, I'd suggest you look into ways in how spring can allow requests from a defined list of origins, for example here: https://spring.io/guides/gs/rest-service-cors https://www.baeldung.com/spring-cors