CSRF disable doesn't work in Spring Security - spring

Question

I'm currently testing a REST API with Spring Security. Because this is just testing, I'm disabling CSRF. With the code below, a Postman get request to /users works perfectly, but any other type of request from Postman (e.g. post, delete, put) give me back a 403 FORBIDDEN error. Really can't figure it out.
#Configuration
#EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.anyRequest()
.authenticated()
.and()
.httpBasic();
}
}

Answer 1

Do you have any cors configuration setup to allow methods other than "GET"?
You can create a CorsConfigurationSource bean that should allow access to those types of requests
#Configuration
public class CorsConfig {
private static final String[] CORS_ALLOWED_HEADERS = new String[] {
"*",
};
private static final String[] CORS_ALLOWED_METHODS = new String[] {
"GET",
"POST",
"PUT",
"OPTIONS"
};
private static final String CORS_API_PATTERN = "/api/**";
private static final long CORS_MAX_AGE = 3600;
#Value("${cors.allowed-origins}")
private String[] corsAllowedOrigins;
#Bean
public CorsConfigurationSource corsConfigurationSource() {
final CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList(corsAllowedOrigins));
configuration.setAllowedMethods(Arrays.asList(CORS_ALLOWED_METHODS));
configuration.setAllowCredentials(true);
configuration.setMaxAge(CORS_MAX_AGE);
configuration.setAllowedHeaders(Arrays.asList(CORS_ALLOWED_HEADERS));
final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration(CORS_API_PATTERN, configuration);
return source;
}