title: CORS error in Spring Oauth2
body: <p>I'm using Spring security and Oauth2. But I'm new to Spring Oauth2, I Got the CORS error when front-end attends to access resource. </p>
  
  <p>I'm using the below filter to allow other domains to access the resource:</p>
  
  <pre><code>@Component
  @Order(Integer.MAX_VALUE)
  public class SimpleCORSFilter implements Filter {
  
      public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
          HttpServletResponse response = (HttpServletResponse) res;
          response.setHeader("Access-Control-Allow-Credentials", "True");
          response.setHeader("Access-Control-Allow-Origin", "*");
          response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
          response.setHeader("Access-Control-Max-Age", "3600");
          response.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization");
          chain.doFilter(req, res);
      }
  
  
      public void init(FilterConfig filterConfig) {}
      public void destroy() {}
  
  }
  </code></pre>
  
  <p>I wrote the below code to allow public resource in my SecurityConfiguration.java.</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
               http
          .authorizeRequests().antMatchers("/social/facebook/**","/register/**","/public/**").permitAll().and()
          .authorizeRequests().antMatchers("/user/**").hasRole("USER").and()           
          .exceptionHandling()
              .accessDeniedPage("/login.jsp?authorization_error=true")
              .and()
          .csrf()
              .requireCsrfProtectionMatcher(new AntPathRequestMatcher("/oauth/authorize")).disable();
  
  }
  </code></pre>
  
  <p>For Oauth2, the below codes is for protecting user's resource in my OAuth2ServerConfig.java.</p>
  
  <pre><code>@Override
      public void configure(HttpSecurity http) throws Exception {
          http
  
              .requestMatchers().antMatchers("/user/**")
          .and()
              .authorizeRequests()
              .antMatchers("/user/**").access("#oauth2.hasScope('read')")
                  .regexMatchers(HttpMethod.DELETE, "/oauth/users/([^/].*?)/tokens/.*")
                      .access("#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('write')")
                  .regexMatchers(HttpMethod.GET, "/oauth/clients/([^/].*?)/users/.*")
                      .access("#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('read')")
                  .regexMatchers(HttpMethod.GET, "/oauth/clients/.*")
                      .access("#oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.isClient() and #oauth2.hasScope('read')");
      }
  </code></pre>
  
  <p>When I open the index.html file in the browser, like following:(Sorry I don't have at least 10 reputation to post images, so I paste links here)</p>
  
  <pre><code>http://i.stack.imgur.com/yQKJM.png
  </code></pre>
  
  <p>it successfully get the public data, that means other domains are allowed to access "/public/**" data.</p>
  
  <p>But it failed to get "/user/**" data (protected by Oauth2). It gives me below error says "Cross-Origin Request Blocked".</p>
  
  <pre><code>http://i.stack.imgur.com/XIVx1.png
  </code></pre>
  
  <p>When I move the front-end files to the same domain of the Spring server. It works fine to get both "public" and "user" data as below:</p>
  
  <pre><code>http://i.stack.imgur.com/Q2n7F.png
  </code></pre>
  
  <p>The front-end and Back-end should be separated. But the CORS is blocked to access projected data. Can anyone give me some suggestions? Thanks very much. I'm guessing the filter is not working on Oauth2? still spend a lot of time on looking for solutions.</p>