title: Enable CORS support Spring Boot
body: <p>I am trying to enable the CORS support in Spring Boot app but I am not getting successful. I looked into a lot of solutions but none seems to be working for me.</p>
  <p>When I try to make a call from the Angular app to Java backend I see the error in chrome:</p>
  <blockquote>
  <p>Access to XMLHttpRequest at 'http://localhost:8080/..' from origin 'http://localhost:4200' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.</p>
  </blockquote>
  <p>I have enabled CORS in controller method level by adding the following annotation but still I get the preflight request error.</p>
  <pre class="lang-java prettyprint-override"><code>@CrossOrigin(origins = &quot;http://localhost:4200&quot;)
  </code></pre>
  <p>My Spring Security configuration:</p>
  <pre><code>@Configuration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
          
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring().antMatchers(&quot;/**&quot;);
      }
  }
  </code></pre>
  <p>My custom filter:</p>
  <pre class="lang-java prettyprint-override"><code>@Configuration
  public class AuthFilter implements Filter {
  
      @Autowired
      private Environment env;
      
      private static final ApplicationLogger logger = ApplicationLogger.getInstance();
  
      @Override
      public void init(FilterConfig filterConfig) throws ServletException {
          logger.debug(&quot;Initializing authentication filter.&quot;);
  
      }
      
      public boolean checkHeader(HttpServletRequest httpRequest) {
          boolean flag = false;
  
          String applicationName = httpRequest.getHeader(&quot;bar&quot;);
          if (applicationName != null &amp;&amp; applicationName.equalsIgnoreCase(&quot;foo&quot;)) {
              flag = true;
          }
          return flag;
      }
  
      @Override
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
              throws IOException, ServletException {
  
          HttpServletRequest httpRequest = (HttpServletRequest) request;
          HttpServletResponse httpResponse = (HttpServletResponse) response;
          // HttpSession httpSession = httpRequest.getSession();
          List&lt;String&gt; excludedUrls = null;
          String excludePattern = env.getProperty(&quot;excludedUrls&quot;);
          excludedUrls = Arrays.asList(excludePattern.split(&quot;,&quot;));
  
          String path = ((HttpServletRequest) request).getServletPath();
  
          String loginPathURL = env.getProperty(&quot;loginPathURL&quot;);
  
          if (excludedUrls.contains(path) 
                  || path.contains(&quot;/file/..&quot;)
                  || path.contains(&quot;/file/...&quot;)
                  || path.contains(&quot;/file/....&quot;)) {  
              chain.doFilter(request, response);
          } else if (checkHeader(httpRequest)) {
              // Authenticate the request through LDAP
              logger.info(&quot;Authenticating the request ...&quot;);
              chain.doFilter(request, response);
          } else {
              logger.debug(&quot;User is not authenticated&quot;);
              httpResponse.sendRedirect(loginPathURL);
          }
          
      /*  
          HttpServletRequest httpRequest = (HttpServletRequest) request;
          HttpSession httpSession = httpRequest.getSession();
  
          List&lt;String&gt; excludedUrls = null;
          String excludePattern = env.getProperty(&quot;excludedUrls&quot;);
          excludedUrls = Arrays.asList(excludePattern.split(&quot;,&quot;));
  
          String path = ((HttpServletRequest) request).getServletPath();
  
          if (excludedUrls.contains(path)) {
              // Authenticate the request through LDAP
              logger.info(&quot;Authenticating the request ...&quot;);
              chain.doFilter(request, response);
          }
          
          else if(checkHeader(httpRequest)) {
      
          else if (httpSession != null &amp;&amp; httpSession.getAttribute(WorkpermitConstants.CLIENT_AUTH_TOKEN_KEY) != null) {
              
              List&lt;Map&lt;String,Object&gt;&gt;  res = (List&lt;Map&lt;String,Object&gt;&gt;)  jdbcTemplate.queryForList(&quot;some select query&quot;) ;
              
              if(!AppUtil.isObjectEmpty(res.size())) {
              
                  for (Map&lt;String, Object&gt; row : res) {
                      
                      //currentUserEmail
                      //empType
                      //userId
                      //username
                  }
              }
              
              chain.doFilter(request, response);
          } else {
              logger.debug(&quot;User is not authenticated.&quot;);
              HttpServletResponse httpResponse = (HttpServletResponse) response;
              //httpResponse.sendRedirect(httpRequest.getContextPath() + &quot;/&quot;);
              
              httpResponse.sendRedirect(&quot;http://..&quot;);
          }
      */
          // comment below code
          // chain.doFilter(request, response);
      }
  
      @Override
      public void destroy() {
          // TODO Auto-generated method stub
  
      }
  }
  </code></pre>
  <p>I added the following code in my class after looking into few solutions but it did not work for me either.</p>
  <pre class="lang-java prettyprint-override"><code>@Configuration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring().antMatchers(&quot;/**&quot;);
      }
      
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.cors();
      }
  
      @Bean
      CorsConfigurationSource corsConfigurationSource() {
          CorsConfiguration configuration = new CorsConfiguration();
          configuration.setAllowedOrigins(Arrays.asList(&quot;http://localhost:4200&quot;));
          configuration.setAllowedMethods(Arrays.asList(&quot;GET&quot;,&quot;POST&quot;,&quot;OPTIONS&quot;));
          // NOTE: setAllowCredentials(true) is important,
          // otherwise, the value of the 'Access-Control-Allow-Origin' header in the response
          // must not be the wildcard '*' when the request's credentials mode is 'include'.
          configuration.setAllowCredentials(true);
  
          // NOTE: setAllowedHeaders is important!
          // Without it, OPTIONS preflight request will fail with 403 Invalid CORS request
          configuration.setAllowedHeaders(Arrays.asList(
                  &quot;Authorization&quot;,
                  &quot;Accept&quot;,
                  &quot;Cache-Control&quot;,
                  &quot;Content-Type&quot;,
                  &quot;Origin&quot;,
                  &quot;ajax&quot;, 
                  &quot;x-csrf-token&quot;,
                  &quot;x-requested-with&quot;
          ));
          UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          source.registerCorsConfiguration(&quot;/**&quot;, configuration);
          return source;
      }
  }
  </code></pre>
  <p>Spring Boot Version:</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;parent&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
      &lt;version&gt;1.5.9.RELEASE&lt;/version&gt;
      &lt;relativePath /&gt; &lt;!-- lookup parent from repository --&gt;
  &lt;/parent&gt;
  </code></pre>