Pre-flight request is authenticated even if CorsFilter is enabled in Spring Boot - spring

Question

I am using Spring Security for OAuth authentication and I have configured the Cors. However, my all preflight request fails dues to authentication since the preflight request does not have a token(That is how it should be). I have the following configuration class;
SecurityConfiguration.java
#Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
#Override
public void configure(final HttpSecurity security) throws Exception {
security.cors()
.and()
.requestMatchers()
.antMatchers("/actuator/health")
.and()
.authorizeRequests()
.antMatchers("/actuator/health").permitAll()
.and()
.csrf().disable();
// Custom filter to validate if user is authorized and active to access the system
security.addFilterAfter(new AuthorizationFilter(), BasicAuthenticationFilter.class);
}
#Bean
CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration().applyPermitDefaultValues();
configuration.setAllowedMethods(Arrays.asList("GET","HEAD","POST","PUT"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
}
WebMvcConfiguration .java
#Configuration
public; class WebMvcConfiguration implements WebMvcConfigurer {
#Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedMethods("GET","HEAD","POST","PUT");
}
}
Questions:
Why preflight request goes to authentication even if I have CorsFilter enable?
How can I exclude preflight request to be authenticated ?
UPDATE:
I enabled log for debugging the issue using logging.level.org.springframework.security.web.FilterChainProxy: DEBUG in application.yml file.
I fetched the list of filter registered in filter chain and list is as follow :
class org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter
class org.springframework.security.web.context.SecurityContextPersistenceFilter
class org.springframework.security.web.header.HeaderWriterFilter
class org.springframework.web.filter.CorsFilter
class org.springframework.security.web.authentication.logout.LogoutFilter
class org.springframework.security.web.savedrequest.RequestCacheAwareFilter
class org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter
class org.springframework.security.web.authentication.AnonymousAuthenticationFilter
class org.springframework.security.web.session.SessionManagementFilter
class org.springframework.security.web.access.ExceptionTranslationFilter
class org.springframework.security.web.access.intercept.FilterSecurityInterceptor
class org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationFilter
Notice that corsFilter is registered. However, when I get request only following filters are running and not CorsFilter;
'WebAsyncManagerIntegrationFilter'
'SecurityContextPersistenceFilter'
'HeaderWriterFilter'
'LogoutFilter'
'BearerTokenAuthenticationFilter'
'RequestCacheAwareFilter'
'SecurityContextHolderAwareRequestFilter'
'AnonymousAuthenticationFilter'
'SessionManagementFilter'
'ExceptionTranslationFilter'
'FilterSecurityInterceptor'
UPDATE 2:
While testing, I noticed for '/actuator/health', CorsFilter is being called. But I am not sure what does that mean?

Answer 1

Adding the following to your configuration security.cors() should have enabled the CORS filter which should enable the pre-flight request to work without an authorization token.But it seems you have configured your requests machers incorrectly, please use correct url mappings so that the security configuration will apply to all endpoints.
Also,Try setting your allowed origins as well to cover all origins:
#Bean
CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration().applyPermitDefaultValues();
configuration.setAllowedMethods(Arrays.asList("GET","HEAD","POST","PUT"));
configuration.setAllowedOrigins(Arrays.asList("*"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
Guide : https://www.baeldung.com/spring-security-multiple-entry-points