title: How to setup Access-Control-Allow-Origin filter problematically in Spring Security 3.2
body: <p>I am trying to setup my Spring server with Spring Security 3.2 to be able to do an ajax login request.</p>
  
  <p>I followed the <a href="https://www.youtube.com/watch?v=qoR6lY6biO4">Spring Security 3.2</a> video and couple of posts but the issue is that I am getting </p>
  
  <pre><code> No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:9000' is therefore not allowed access. 
  </code></pre>
  
  <p>For the login requests (see below). </p>
  
  <p>I have created a CORSFilter setup and I can access the unprotected resources in my system with the appropriate headers being added to the response. </p>
  
  <p>My guess is that I am not adding the <code>CORSFilter</code> to security filter chain or it may be too late far in the chain. Any idea will be appreciated.     </p>
  
  <p><strong>WebAppInitializer</strong></p>
  
  <pre><code>public class WebAppInitializer implements WebApplicationInitializer {
      @Override
      public void onStartup(ServletContext servletContext) {
          WebApplicationContext rootContext = createRootContext(servletContext);
  
          configureSpringMvc(servletContext, rootContext);
  
          FilterRegistration.Dynamic corsFilter = servletContext.addFilter("corsFilter", CORSFilter.class);
          corsFilter.addMappingForUrlPatterns(null, false, "/*");
      }
  
      private WebApplicationContext createRootContext(ServletContext servletContext) {
          AnnotationConfigWebApplicationContext rootContext = new AnnotationConfigWebApplicationContext();
  
          rootContext.register(SecurityConfig.class, PersistenceConfig.class, CoreConfig.class);
  
          servletContext.addListener(new ContextLoaderListener(rootContext));
          servletContext.setInitParameter("defaultHtmlEscape", "true");
  
          return rootContext;
      }
  
  
      private void configureSpringMvc(ServletContext servletContext, WebApplicationContext rootContext) {
          AnnotationConfigWebApplicationContext mvcContext = new AnnotationConfigWebApplicationContext();
          mvcContext.register(MVCConfig.class);
  
          mvcContext.setParent(rootContext);
          ServletRegistration.Dynamic appServlet = servletContext.addServlet(
                  "webservice", new DispatcherServlet(mvcContext));
          appServlet.setLoadOnStartup(1);
          Set&lt;String&gt; mappingConflicts = appServlet.addMapping("/api/*");
  
          if (!mappingConflicts.isEmpty()) {
              for (String s : mappingConflicts) {
                  LOG.error("Mapping conflict: " + s);
              }
              throw new IllegalStateException(
                      "'webservice' cannot be mapped to '/'");
          }
      }
  </code></pre>
  
  <p><strong>SecurityWebAppInitializer:</strong></p>
  
  <pre><code>public class SecurityWebAppInitializer extends AbstractSecurityWebApplicationInitializer {
  }
  </code></pre>
  
  <p><strong>SecurityConfig:</strong></p>
  
  <p>Requests to <em>/api/users</em> - work well and the Access-Control-Allow headers are added .
  I disabled csrf and headers just to make sure this is not the case </p>
  
  <pre><code>@EnableWebMvcSecurity
  @Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
      protected void registerAuthentication(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication()
                  .withUser("user").password("password").roles("USER");
      }
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf().disable()
              .headers().disable()                
              .authorizeRequests()
                      .antMatchers("/api/users/**").permitAll()
                      .anyRequest().authenticated()
                      .and()
              .formLogin()
                  .loginPage("/login")
                  .permitAll()
                  .and()
              .logout()
                  .permitAll();
      }
  </code></pre>
  
  <p><strong>CORFilter:</strong> </p>
  
  <pre><code>@Component
  public class CORSFilter implements Filter{
      static Logger logger = LoggerFactory.getLogger(CORSFilter.class);
  
      @Override
      public void init(FilterConfig filterConfig) throws ServletException {
      }
  
      @Override
      public void doFilter(ServletRequest request, ServletResponse res, FilterChain chain) throws IOException, ServletException {
          HttpServletResponse response = (HttpServletResponse) res;
          response.setHeader("Access-Control-Allow-Origin", "*");
          response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
          response.setHeader("Access-Control-Max-Age", "3600");
          response.setHeader("Access-Control-Allow-Headers", "x-requested-with");
          chain.doFilter(request, response);
      }
  
      public void destroy() {}
  }
  </code></pre>
  
  <p><strong>Login Request:</strong> </p>
  
  <pre><code>Request URL:http://localhost:8080/devstage-1.0/login
  Request Headers CAUTION: Provisional headers are shown.
  Accept:application/json, text/plain, */*
  Cache-Control:no-cache
  Content-Type:application/x-www-form-urlencoded
  Origin:http://127.0.0.1:9000
  Pragma:no-cache
  Referer:http://127.0.0.1:9000/
  User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36
  Form Dataview sourceview URL encoded
  username:user
  password:password
  </code></pre>