title: Spring Security CORS Issue: "OPTIONS http://localhost:8080/ 403 ()"
body: <p>I've been working on a project using spring + spring security on my backend and have recently run into an issue with cors specifically:</p>
  
  <p><a href="https://i.stack.imgur.com/NAmzp.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/NAmzp.png" alt="The first two lines you can see successful api call output, following that chrome attempts to send http request with an options header to my rest service."></a></p>
  
  <p>The first two lines you can see <strong>successful api call output</strong>, following that chrome attempts to send a Http request with an options header to my rest service.</p>
  
  <hr>
  
  <p><strong><em>My question is what could potentially be the source of this issue?</em></strong> </p>
  
  <hr>
  
  <p>My front end in dev uses the angular CLI client, I havent had any issues with CORS until i created a custom filter for spring security hence adding my <code>WebConfigurerAdapter</code> config. Happy to supply additional code if required. However I don't think its related to that as I've removed the filter and the same issue occurs.</p>
  
  <p>Tested in chrome, firefox and ubuntu browser same issue occurs.</p>
  
  <p><strong>Angular CLI is successfully proxying calls to '/api/[blah]'</strong>
  <a href="https://i.stack.imgur.com/aFutr.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/aFutr.png" alt="Angular CLI is Proxying my rest service"></a></p>
  
  <p>Here's my proxy config, i've tried just matching on everything but that makes no difference.</p>
  
  <pre><code>{
  "/api/*": {
    "target": "http://localhost:8080",
    "secure": false,
    "logLevel": "debug",
    "changeOrigin": true
  }
  </code></pre>
  
  <p>}</p>
  
  <p><code>WebSecurityAdapter</code> Config</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
  
      http
              .httpBasic()
              .and()
              .authorizeRequests()
              .antMatchers("/index.html",  "/api/registration", "/api/authenticate",
                      "/api/isAuthenticated", "/api/validateCaptcha", "/console", "/api/loginRecaptchaRequired", "/api/login", "/")
              .permitAll()
              .anyRequest()
              .authenticated()
              .and()
              .addFilterBefore(
                      authenticationFilter(),
                      UsernamePasswordAuthenticationFilter.class)
              .logout()
              .logoutUrl("/api/logout")
              .and()
              .csrf()
              .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
              .and()
              .addFilterAfter(csrfHeaderFilter(), SessionManagementFilter.class);
  
  }
  </code></pre>
  
  <p>Request headers:
  <a href="https://i.stack.imgur.com/8WawC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8WawC.png" alt="enter image description here"></a></p>