title: How to alter allowed headers in Spring Boot
body: <p>I'm currently using Auth0 (and an Angular 2 GUI), which sends a header of the type <code>"x-xsrf-token"</code> in the request to a Spring Boot API.  </p>
  
  <p>I get the error: </p>
  
  <blockquote>
    <p>"XMLHttpRequest cannot load <a href="http://localhost:3001/ping" rel="nofollow">http://localhost:3001/ping</a>. Request header
    field x-xsrf-token is not allowed by Access-Control-Allow-Headers in
    preflight response."</p>
  </blockquote>
  
  <p>This is fair enough as the list of Access-Control-Response-Headers in Response Headers does not include <code>x-xsrf-token</code> (when debugging the request in the network tab in Chrome).</p>
  
  <p>I have tried a number of solutions, the closest I think I have come is to override the configure method in <code>AppConfig</code>, and add in my own <code>CorsFilter</code>, like below:</p>
  
  <pre><code>(Imports removed for brevity)
  
  @Configuration
  @EnableWebSecurity(debug = true)
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  public class AppConfig extends Auth0SecurityConfig {
  
      @Bean
      public Auth0Client auth0Client() {
          return new Auth0Client(clientId, issuer);
      }
  
      @Bean
      public Filter corsFilter() {
          UrlBasedCorsConfigurationSource source = new     UrlBasedCorsConfigurationSource();
          CorsConfiguration config = new CorsConfiguration();
          config.setAllowCredentials(true);
          config.addAllowedOrigin("*");
          config.addAllowedHeader("Content-Type");
          config.addAllowedHeader("x-xsrf-token");
          config.addAllowedHeader("Authorization");
          config.addAllowedHeader("Access-Control-Allow-Headers");
          config.addAllowedHeader("Origin");
          config.addAllowedHeader("Accept");
          config.addAllowedHeader("X-Requested-With");
          config.addAllowedHeader("Access-Control-Request-Method");
          config.addAllowedHeader("Access-Control-Request-Headers");
          config.addAllowedMethod("OPTIONS");
          config.addAllowedMethod("GET");
          config.addAllowedMethod("PUT");
          config.addAllowedMethod("POST");
          config.addAllowedMethod("DELETE");
          source.registerCorsConfiguration("/**", config);
  
          return new CorsFilter(source);
      }
  
      @Override
      protected void authorizeRequests(final HttpSecurity http) throws Exception {
          http.authorizeRequests().antMatchers("/ping").permitAll().antMatchers("/").permitAll().anyRequest()
              .authenticated();
      }
  
      String getAuthorityStrategy() {
          return super.authorityStrategy;
      }
  
      @Override
      protected void configure(final HttpSecurity http) throws Exception {
          http.csrf().disable();
          http.addFilterAfter(auth0AuthenticationFilter(auth0AuthenticationEntryPoint()),
              SecurityContextPersistenceFilter.class)
              .addFilterBefore(simpleCORSFilter(), Auth0AuthenticationFilter.class);
          authorizeRequests(http);http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  
          http.cors();
          }
      }
  </code></pre>
  
  <p>Unfortunately I have had no success with this, and still see the <code>x-xsrf-token</code> missing in the response header of my get request.</p>
  
  <p>My base project is this: 
  <a href="https://github.com/auth0-samples/auth0-spring-security-api-sample/tree/master/01-Authentication/src/main" rel="nofollow">https://github.com/auth0-samples/auth0-spring-security-api-sample/tree/master/01-Authentication/src/main</a></p>
  
  <p>Any ideas would be welcome.</p>