title: Spring CorsFilter does not seem to work still receiving a 401 on preflight requests
body: <p>Hi I'm new to spring security and trying to figure out how to configure auth server to issue tokens. the problem i have right now is that I'm receiving 401 or 403 on the Cors preflight requests and not sure how to resolve below is a barebone implementation of it based on few tutorials </p>
  
  <p><a href="https://spring.io/blog/2015/06/08/cors-support-in-spring-framework" rel="nofollow">https://spring.io/blog/2015/06/08/cors-support-in-spring-framework</a>
  <a href="http://www.baeldung.com/spring-security-oauth-jwt" rel="nofollow">http://www.baeldung.com/spring-security-oauth-jwt</a></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity
  @PropertySource(value = "classpath:oauth.properties")
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      UserRepository userRepository;
  
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth)
              throws Exception {
          auth.authenticationProvider(authenticationProvider());
      }
  
  
      @Override
      public void configure(WebSecurity web) throws Exception {
  
          super.configure(web);
      }
  
      @Autowired
      ObjectMapper mapper;
  
  
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable();
  
          http.authorizeRequests().antMatchers(HttpMethod.OPTIONS,"/oauth/token").permitAll()
          .anyRequest().authenticated();
      }
  
  
  
  
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Override
      protected void configure(final AuthenticationManagerBuilder auth) throws Exception{
  
          auth.inMemoryAuthentication().
          withUser("john").password("123").roles("USER").
          and().
          withUser("tom").password("111").roles("ADMIN");
  
      }
      @Bean
      public FilterRegistrationBean corsFilter() {
          FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter2());
          bean.setOrder(0);
          return bean;
      }
  
  
  }
  
  
  @Configuration
  @EnableAuthorizationServer
  public class OAuth2ServerConfig extends AuthorizationServerConfigurerAdapter{
  
      @Autowired
      private Environment env;
  
      @Autowired
      @Qualifier("authenticationManagerBean")
      private AuthenticationManager authenticationManager;
  
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer oauthServer){
          oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
      }
  
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception{
          clients.inMemory().withClient("acme").secret("acmesecret").authorizedGrantTypes("authorization_code", "refresh_token",
                    "password").scopes("openId");
      }
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints){
          final TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
          tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer(),accessTokenConverter()));
          endpoints.tokenStore(tokenStore())
                   .tokenEnhancer(tokenEnhancerChain)
                   .authenticationManager(authenticationManager);
  
      }
  
      @Bean
      public JwtAccessTokenConverter accessTokenConverter(){
          final JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
          return converter;
      }
  
      @Bean
      public TokenStore tokenStore(){
  
          return new JwtTokenStore(accessTokenConverter());
  
      }
  
      @Bean
      public FilterRegistrationBean corsFilter() {
          FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter2());
          bean.setOrder(0);
          return bean;
      }
  
      @Bean
      @Primary
      public DefaultTokenServices tokenServices() {
          DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
          defaultTokenServices.setTokenStore(tokenStore());
          defaultTokenServices.setSupportRefreshToken(true);
          return defaultTokenServices;
      }
  }
  </code></pre>
  
  <p>the CorsFilter2 is spring cors filter that was introduced in spring 4.2 I was i'm using it to insert the proper response headers to send back to the client.</p>