Allow origins in Spring 5.7.3 - spring-boot

Question

I'm lost with CORS again :(
I followed docs and set up my WebConfig like this:
#EnableWebSecurity
class WebSecurityConfig() {
#Bean
fun corsConfigurationSource(): CorsConfigurationSource = CorsConfiguration()
.apply { allowedOrigins = listOf("http://localhost:3000", "*") }
.apply { allowedMethods = listOf("*") }
.let { corsConfig ->
UrlBasedCorsConfigurationSource().apply { registerCorsConfiguration("/**", corsConfig) }
}
#Bean
fun configure(http: HttpSecurity): SecurityFilterChain {
http
.csrf().disable()
.cors { }
http.sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
http
.authorizeRequests()
.antMatchers(
"/auth/**",
"**/demo",
).permitAll()
.anyRequest().authenticated()
http.exceptionHandling { it.authenticationEntryPoint { _, response, authException ->
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, authException.message)
} }
http.addFilterBefore(jwtTokenFilter, UsernamePasswordAuthenticationFilter::class.java)
return http.build()
}
}
and I still get CORS error, "http://localhost:3000" being blocked. I tried multiple variations, followed multiple tutorials and I just can't solve this one.
Did I make and error that I can't see?
Edit: When I "solved" this I encountered another irrational problem. Apparently the core problem was in editor/browser. After restart everything works as expected.
Guys, if you think something should work and it doesn't, just try to restart editor and browser. It may save you 2 days.
I'm going to add that CorsConfigurationSource can be replaced by CorsFilter bean.
fun corsFilter() : CorsFilter
fun corsConfigurationSource() : CorsConfigurationSource

Answer 1

It's really strange but after adding allowedHeaders to CorsConfiguration it works fine:
CorsConfiguration()
.apply {
allowedOrigins = listOf("http://localhost:3000")
allowedMethods = listOf("*")
allowedHeaders = listOf("*")
}
I know it's weird because spring doesn't mention allowedHeaders in their docs, but I verified this solution both on my localhost and AWS deploy and in both cases I get cors error if I omit allowedHeaders.
Very good tip is also to check Disable cache checkbox in your DevTools -> Network tab when testing your cors implementation.
To make it complete, cors can be configured by implementing of one of two beans:
fun corsFilter() : CorsFilter
fun corsConfigurationSource() : CorsConfigurationSource