CORS in Spring Boot - spring

Question

I'm trying to set up my server application with cors configuration.
Here the configuration, but any cors request on login will has a 403 response code:
#Configuration
#EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private final JwtAuthenticationEntryPoint unauthorizedHandler;
#Autowired
public WebSecurityConfig(JwtAuthenticationEntryPoint unauthorizedHandler) {
this.unauthorizedHandler = unauthorizedHandler;
}
#Bean
CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Collections.singletonList("*"));
configuration.setAllowedMethods(Collections.singletonList("*"));
configuration.setAllowedHeaders(Collections.singletonList("*"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.addFilterBefore(new JwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class)
.cors().and()
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
.csrf().disable()
.antMatcher("/api/**").authorizeRequests()
.antMatchers("/login/**").permitAll()
.anyRequest().authenticated();
}
}
EDIT
I've solved adding another configuration class and removing beand from websecurity one.
Just understand that the cors configuration has to be configured on Spring Boot and not on Spring Security.
The class I've add is:
#Configuration
public class CorsConfig implements WebMvcConfigurer {
#Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins("*")
.allowedMethods("GET", "POST", "PUT", "DELETE", "HEAD")
.allowedHeaders("*")
.allowCredentials(true);
}
}
And the WebSeurityConfig one has become:
#Configuration
#EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private final JwtAuthenticationEntryPoint unauthorizedHandler;
#Autowired
public WebSecurityConfig(JwtAuthenticationEntryPoint unauthorizedHandler) {
this.unauthorizedHandler = unauthorizedHandler;
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.addFilterBefore(new JwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class)
.cors().and()
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
.csrf().disable()
.antMatcher("/api/**").authorizeRequests()
.antMatchers("/login/**").permitAll()
.anyRequest().authenticated();
}
}
Now all works as expected, cors is managed correctly on all endpoints

Answer 1

Try this one
#Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**") //or the URLs you would like to add
.allowedMethods("GET", "POST");
}

Answer 2

Try this:
#Override
protected void configure(HttpSecurity http) throws Exception {
http.addFilterBefore(new JwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class)
.cors().and()
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
.csrf().disable()
.antMatcher("/api/**").authorizeRequests()
.antMatchers(HttpMethod.OPTIONS,"/login/**").permitAll() // this
.anyRequest().authenticated();