Enabling Cross Origin Requests Spring Boot

Question

I'm developing an application which consists of a backend application developed with Spring Boot and a frontend application developed with Angular 8. Now I want to enable Cross Origin to let the frontend call backend's API.
Following the Spring documentation about CORS I wrote the following configuration class:

@EnableWebSecurity
public class WebConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors();
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource()
    {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("http://localhost:4200"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

The first attempt was to set the AllowedOrigins to Arrays.asList("*").

When I call the api /dinners/ingredients from my Angular application I found the following error in the console:

Access to XMLHttpRequest at 'http://localhost:8081/dinners/ingredients?page=0&pageSize=10' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
GET http://localhost:8081/dinners/ingredients?page=0&pageSize=10 net::ERR_FAILED

Am I missing something in the configuration of the backend application? I don't see the 'Access-Control-Allow-Origin' header in the header response in Postman:

Could you try if it works with configuration.applyPermitDefaultValues()? — Sergii Zhevzhyk
Turns out that the context-path of the backend was dinner and not dinners.. The error was not that self-explanatory. — A. Wolf

Toerktumlare Toerktumlare · Accepted Answer · 2020-01-15T23:09:34

the documentation you have posted refers to spring security 4.2 (you can see that in the url you provided) if you instead look into the more recent spring security documentation (5.x) you will see that for the standard implemented cors filter to be configured with an external bean, you need to call the withDefaults() method.

Cors configuration spring 5.x

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // by default uses a Bean by the name of corsConfigurationSource
            .cors(withDefaults()) // <------ this part
            ...
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
        configuration.setAllowedMethods(Arrays.asList("GET","POST"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

Enabling Cross Origin Requests Spring Boot

3 Answers