title: How to fix Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin'?
body: <p>I always encounter this in Frontend says Access to XMLHttpRequest at 'api/abc/xyz' from origin 'localhost://2800/api/abc/xyz' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.</p>
  
  <p>I tried this to add in Backend
  `</p>
  
  <pre><code> http.authorizeRequests()
       .antMatchers(HttpMethod.OPTIONS).permitAll()
       .anyRequest().authenticated();
  </code></pre>
  
  <p>`</p>
  
  <p>and my frontend AJAX CALL API:
   `</p>
  
  <pre><code>$.ajax({
          'type': 'GET',
          'url': '/api/vessel/?vesselId=' + $('#vessel_id').val() + '&amp;page=1&amp;size=100',
          'headers': {
              "Content-Type": "application/json",
              "Accept": "application/json",
              "Authorization": `Bearer ${session}`
          },
          success: function(response) {console.log(response)}
   });
  </code></pre>
  
  <p>`</p>
  
  <p>But after that I still encounter that error.</p>
  
  <p>`   </p>
  
  <pre><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
  
          // Disable CSRF (cross site request forgery)
          http.csrf().disable();
  
          // No session will be created or used by spring security
          http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  
          // Entry points
          http.authorizeRequests()
                  .antMatchers(HttpMethod.OPTIONS).permitAll()
                  // Disallow everything else..
                  .anyRequest().authenticated();
  
  
          // If a user try to access a resource without having enough permissions
          //http.exceptionHandling().accessDeniedPage("/login");
  
          // Apply JWT
          http.apply(new JwtTokenFilterConfigurer(jwtTokenProvider));
  
          // Optional, if you want to test the API from a browser
          // http.httpBasic();
      }
  </code></pre>
  
  <p>`</p>