title: CORS in Spring Boot
body: <p>I'm trying to set up my server application with cors configuration.
  Here the configuration, but any cors request on <code>login</code> will has a 403 response code:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      private final JwtAuthenticationEntryPoint unauthorizedHandler;
  
      @Autowired
      public WebSecurityConfig(JwtAuthenticationEntryPoint unauthorizedHandler) {
          this.unauthorizedHandler = unauthorizedHandler;
      }
  
      @Bean
      CorsConfigurationSource corsConfigurationSource() {
          CorsConfiguration configuration = new CorsConfiguration();
          configuration.setAllowedOrigins(Collections.singletonList("*"));
          configuration.setAllowedMethods(Collections.singletonList("*"));
          configuration.setAllowedHeaders(Collections.singletonList("*"));
          UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          source.registerCorsConfiguration("/**", configuration);
          return source;
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.addFilterBefore(new JwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class)
              .cors().and()
              .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
              .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
              .csrf().disable()
              .antMatcher("/api/**").authorizeRequests()
              .antMatchers("/login/**").permitAll()
              .anyRequest().authenticated();
  
  }
  </code></pre>
  
  <p>}</p>
  
  <p><strong>EDIT</strong>
  I've solved adding another configuration class and removing beand from websecurity one.</p>
  
  <p>Just understand that the cors configuration has to be configured on Spring Boot and not on Spring Security.</p>
  
  <p>The class I've add is:</p>
  
  <pre><code>@Configuration
  public class CorsConfig implements WebMvcConfigurer {
  
      @Override
      public void addCorsMappings(CorsRegistry registry) {
  
           registry.addMapping("/**")
              .allowedOrigins("*")
              .allowedMethods("GET", "POST", "PUT", "DELETE", "HEAD")
              .allowedHeaders("*")
              .allowCredentials(true);
      }
  
  }
  </code></pre>
  
  <p>And the WebSeurityConfig one has become: </p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      private final JwtAuthenticationEntryPoint unauthorizedHandler;
  
      @Autowired
      public WebSecurityConfig(JwtAuthenticationEntryPoint unauthorizedHandler) {
          this.unauthorizedHandler = unauthorizedHandler;
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.addFilterBefore(new JwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class)
              .cors().and()
              .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
              .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
              .csrf().disable()
              .antMatcher("/api/**").authorizeRequests()
              .antMatchers("/login/**").permitAll()
              .anyRequest().authenticated();
  
  }
  </code></pre>
  
  <p>}</p>
  
  <p>Now all works as expected, cors is managed correctly on all endpoints</p>