title: Spring Boot Security CORS
body: <p>I have a problem with CORS filter on spring security URL's.
  It doesn't set <code>Access-Control-Allow-Origin</code> and other exposed header on URL's belonging to spring sec (login/logout) or filtered by Spring Security.</p>
  
  <p>Here are the configurations.</p>
  
  <p><strong>CORS:</strong></p>
  
  <pre><code>@Configuration
  @EnableWebMvc
  public class MyWebMvcConfig extends WebMvcConfigurerAdapter {
  ********some irrelevant configs************
      @Override
      public void addCorsMappings(CorsRegistry registry) {
          registry.addMapping("/*").allowedOrigins("*").allowedMethods("GET", "POST", "OPTIONS", "PUT")
                  .allowedHeaders("Content-Type", "X-Requested-With", "accept", "Origin", "Access-Control-Request-Method",
                          "Access-Control-Request-Headers")
                  .exposedHeaders("Access-Control-Allow-Origin", "Access-Control-Allow-Credentials")
                  .allowCredentials(true).maxAge(3600);
      }
  }
  </code></pre>
  
  <p><strong>Security:</strong></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint).and()
                  .formLogin()
                      .successHandler(ajaxSuccessHandler)
                      .failureHandler(ajaxFailureHandler)
                      .loginProcessingUrl("/authentication")
                      .passwordParameter("password")
                      .usernameParameter("username")
                  .and()
                  .logout()
                      .deleteCookies("JSESSIONID")
                      .invalidateHttpSession(true)
                      .logoutUrl("/logout")
                      .logoutSuccessUrl("/")
                  .and()
                  .csrf().disable()
                  .anonymous().disable()
                  .authorizeRequests()
                  .antMatchers("/authentication").permitAll()
                  .antMatchers("/oauth/token").permitAll()
                  .antMatchers("/admin/*").access("hasRole('ROLE_ADMIN')")
                  .antMatchers("/user/*").access("hasRole('ROLE_USER')");
      }
  }
  </code></pre>
  
  <p>So, if I make a request to the url's which are not listened by security - CORS headers are set. Spring security URL's - not set.</p>
  
  <p><strong>Spring boot 1.4.1</strong></p>