title: "addCorsMapping" blocking Swagger UI
body: <p>I'm working on a Spring application and I have some troubles with Swagger and Spring Security.
  I had to add a specific configuration to allow almost every access (CORS) and it worked well so far, but somehow it is blocking Swagger....</p>
  
  <p>This is my SwaggerConfiguration.java</p>
  
  <pre><code>@Configuration
  @EnableSwagger2
  @SwaggerDefinition(
          info = @Info(
                  description = "Web Service",
                  version = "V0.0.1",
                  title = "Web Service",
                  contact = @Contact(
                          name = "Me",
                          email = "dev@me.com",
                          url = "https://www.me.com/"
                  )
          ),
          consumes = {"application/json"},
          produces = {"application/json"},
          schemes = {SwaggerDefinition.Scheme.HTTP, SwaggerDefinition.Scheme.HTTPS}
  )
  public class SwaggerConfiguration {
  
      /** List of Swagger endpoints (used by {@code WebSecurityConfig}) */
      static final String[] SWAGGER_ENDPOINTS = {
              "/v2/api-docs",
              "/swagger-resources",
              "/swagger-resources/**",
              "/configuration/ui",
              "/configuration/security",
              "/swagger-ui.html",
              "/webjars/**"
      };
  
      @Bean
      public Docket swaggerSpringMvcPlugin() {
          return new Docket(DocumentationType.SWAGGER_2)
                  .groupName("admin-api")
                  .select()
                  .paths(paths()) // and by paths
                  .build();
      }
  
      private Predicate&lt;String&gt; paths() {
          return or(
                  regex("/admin.*"),
                  regex("/issuer.*"),
                  regex("/validator.*"),
                  regex("/data.*"));
  
      }
  }
  </code></pre>
  
  <p>And this is my WebSecurityConfig.java :</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private JwtTokenDecoder jwtTokenDecoder;
  
  
      @Bean
      // Mandatory to be able to have % in URL
      // FIXME Set it only for dev environment
      public HttpFirewall allowUrlEncodedPercentHttpFirewall() {
          StrictHttpFirewall firewall = new StrictHttpFirewall();
          firewall.setAllowUrlEncodedPercent(true);
          firewall.setAllowUrlEncodedSlash(true);
  
          return firewall;
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable()
                  .httpBasic().disable()
                  .formLogin().disable()
                  .logout().disable()
                  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  
          // Install the JWT authentication filter
          http.addFilterBefore(new JwtAuthenticationFilter(jwtTokenDecoder), BasicAuthenticationFilter.class);
  
          // Authorize only authenticated requests
          http.authorizeRequests()
                  .anyRequest().authenticated();
  
         http.cors();
      }
  
      @Override
      public void configure(WebSecurity web) {
          // Allow access to /admin/login without authentication
          web.ignoring().mvcMatchers("/admin/login", "/admin/validate", "/campaigns", "/data/**", "/issuer/**", "/validator/**");
          web.ignoring().antMatchers(SwaggerConfiguration.SWAGGER_ENDPOINTS);
          web.httpFirewall(allowUrlEncodedPercentHttpFirewall());
      }
  }
  </code></pre>
  
  <p>Finally, I have a WebConfig.java used to set CORS authorizations.
  Here it is :</p>
  
  <pre><code>@Configuration
  @EnableWebMvc
  public class WebConfig implements WebMvcConfigurer {
      @Override
      public void addCorsMappings(CorsRegistry registry) {
          registry.addMapping("/**")
                      .allowedOrigins("*")
                      .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE");
      }
  }
  </code></pre>
  
  <p>Very simple. It should authorize almost any access.
  When I remove it, Swagger is available from URL localhost:8080/swagger-ui.html (but not my webservices...)
  When I put it back, it is blocked, with a 403 error (forbidden)</p>
  
  <p>Any idea of what I am missing ?</p>