title: CORS policy and Spring Security
body: <p>I can register, update and delete everything. However, when I will
  request security, I'm blocked by CORS.</p>
  <p><code>Access to XMLHttpRequest at 'http://localhost:8080/oauth/token' from origin 'http://localhost:4200' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.</code></p>
  <p>My cors config class:</p>
  <pre><code>@Configuration
  public class WebConfig {
  
      @Bean
      public WebMvcConfigurer corsConfiguration(){
          return new WebMvcConfigurer() {
              @Override
              public void addCorsMappings(CorsRegistry registry) {
                  registry.addMapping(&quot;/**&quot;)
                          .allowedMethods(&quot;GET&quot;, &quot;POST&quot;, &quot;PUT&quot;, &quot;DELETE&quot;)
                          .allowedHeaders(&quot;*&quot;)
                          .allowedOrigins(&quot;http://localhost:4200&quot;);
              }
          };
      }
  </code></pre>
  <p>In SecurityConfig.class:</p>
  <pre><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              //resguarda aplicações web dentro do projeto
              .csrf().disable()
              .cors()
          .and()
              .sessionManagement()
              //aplicação não guardará sessões (será pelo token)
              .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
      }
  </code></pre>
  <p>authService.ts:</p>
  <pre><code>tentarLogar(username: string, password: string): Observable&lt;any&gt;{
      const params = new HttpParams()
                          .set('username', username)
                          .set('password', password)
                          .set('grant_type', 'password')
      
      const headers = {
        'Authorization': 'Basic ' + btoa(`${this.clientID}:${this.clientSecret}`),
        'Content-Type': 'application/x-www-form-urlencoded'
      }
  
      return this.http.post(this.tokenURL, params.toString, {headers})
    }
  </code></pre>
  <p>If needs more some code please tell me.
  But as I said, with this configuration I can access the API, the real problem is not being able to access <code>localhost:8080/oauth/token</code> to get the JWT token.</p>
  <p><strong>EDIT:</strong></p>
  <p>new CorsConfiguration.class:</p>
  <pre><code>@Component
  @Order(Ordered.HIGHEST_PRECEDENCE)
  public class WebConfig implements Filter {
  
      @Override
      public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
                           FilterChain filterChain) throws IOException, ServletException {
          HttpServletResponse response = (HttpServletResponse) servletResponse;
          HttpServletRequest request = (HttpServletRequest) servletRequest;
          response.setHeader(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
          response.setHeader(&quot;Access-Control-Allow-Methods&quot;, &quot;POST, GET, OPTIONS, PUT, DELETE&quot;);
          response.setHeader(&quot;Access-Control-Max-Age&quot;, &quot;3600&quot;);
          response.setHeader(&quot;Access-Control-Allow-Headers&quot;, &quot;x-requested-with, Authorization, Content-Type&quot;);
  
          if (&quot;OPTIONS&quot;.equalsIgnoreCase(request.getMethod())) {
              response.setStatus(HttpServletResponse.SC_OK);
          } else {
              filterChain.doFilter(request, response);
          }
      }
  
  }
  </code></pre>