title: CrossOrigin with http security using jwt token in Spring boot
body: <p>I have some issue regarding crossorigin and http security in my spring boot application. 
  I want to use http security when I annotate a method with @crossorigin in my controller class.
  But it doesnt seams to work, the security is always triggered even if the method is not using @crosorigin.</p>
  
  <p>Is it possible to fix this?</p>
  
  <p>Jwtautoconfig class:</p>
  
  <pre><code>@ManagementContextConfiguration
  @ConditionalOnProperty(name = {"af.security.active"}, havingValue = "true")
  @Import({EnvironmentConfig.class, JwkRepository.class, JwtTokenUtil.class, 
  JwtAuthenticationProvider.class})
  @EnableWebSecurity
  @EnableConfigurationProperties(JwtSecurityProperties.class)
  @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
  @Order(Ordered.HIGHEST_PRECEDENCE)
  public class JwtAutoConfig extends WebSecurityConfigurerAdapter {
  
  
  @Value("${af.security.jwt.white-list}")
  private  String[] ignoredPaths;
  
  @Value("${af.security.job-seeker-role:arbetssökande}")
  private String jobSeekerRole;
  
  @Value("${af.security.officer-role:handläggare}")
  private String officer;
  
  @Bean(name = "jwtauthenticationentrypoint")
  public JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint() {
  
      return new JwtAuthenticationEntryPoint();
  }
  
  @Bean
  public JwtSecurityHelper securityHelper(){
      return new JwtSecurityHelper(jobSeekerRole, officer);
  }
  
  
  
  @Bean
  public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
      JwtAuthenticationTokenFilter authenticationTokenFilter = new JwtAuthenticationTokenFilter();
      authenticationTokenFilter.setAuthenticationManager(authenticationManager());
      authenticationTokenFilter.setAuthenticationSuccessHandler(new JwtAuthenticationSuccessHandler());
      return authenticationTokenFilter;
  }
  
  @Override
  public void configure(HttpSecurity http) throws Exception {
      http.requestMatchers()
              .and()
              .authorizeRequests()
              .antMatchers("/**")
              .authenticated()
              .and()
              .sessionManagement()
              .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
              .and()
              .csrf()
              .disable();
  
      // Custom JWT based security filter
      http.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
  
      // disable page caching
      http.headers().cacheControl();
  }
  
  @Override
  public void configure(WebSecurity web) {
      final String[] trimmedIgnoredPaths = Stream.of(ignoredPaths)
              .map(String::trim)
              .toArray(String[]::new);
  
      web.ignoring()
              .antMatchers(HttpMethod.OPTIONS,"/**")
              .and()
              .ignoring().antMatchers(trimmedIgnoredPaths);
  }
  
  
  private Config hazelCastConfig(){
      Config config = new Config();
      config.setInstanceName("app-cache")
              .setNetworkConfig(new NetworkConfig()
                      .setJoin(new JoinConfig()
                              .setMulticastConfig(new MulticastConfig()
                                      .setEnabled(false)
                              )
                      )
              )
              .addMapConfig(
                      new MapConfig()
                              .setName("object-cache")
                              .setMaxSizeConfig(new MaxSizeConfig(10, MaxSizeConfig.MaxSizePolicy.FREE_HEAP_SIZE))
                              .setEvictionPolicy(EvictionPolicy.LRU)
                              .setStatisticsEnabled(true)
                              .setTimeToLiveSeconds(14400));
      return config;
  }
  
  @Bean(name="hazelcast")
  public HazelcastInstance hazelcastInstance() {
  
      HazelcastInstance hazelcastInstance = new HazelcastInstanceFactory(hazelCastConfig()).getHazelcastInstance();
      return hazelcastInstance;
  }
  
  }
  </code></pre>
  
  <p>CorsConfig class:</p>
  
  <pre><code>@Configuration
  public class CorsConfig {
  
  @Bean
  public WebMvcConfigurer corsConfigurer()
  {
      return new WebMvcConfigurer() {
          @Override
          public void addCorsMappings(CorsRegistry registry) {
              registry.addMapping("/**")
                      .allowedOrigins("*")
                      .allowedMethods("POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "DELETE", "GET" )
                      .allowCredentials(true);
          }
      };
  }
  }
  </code></pre>
  
  <p>And this is the method in my controller class:</p>
  
  <pre><code>    @ApiOperation(value = "Hämtar alla frånvaron för en lista med användare")
  @PostMapping(path= "/hamta-alla-franvaron", produces = MediaType.APPLICATION_JSON_VALUE)
  public ResponseEntity&lt;List&lt;ExternalFranvaroDTO&gt;&gt; hamtaAllaFranvaron(
          @ApiParam(value = "Identitet objekt som innehåller en lista av PISA_ID", required = true)
          @Valid @RequestBody IdentitetForm identitet){
      logger.info("MOTTAGET Rest-anrop (/hamta-alla-franvaron) Hamtar alla franvaron");
      List&lt;ExternalFranvaroDTO&gt; externalFranvaroDTOLista = new ArrayList&lt;&gt;();
      List&lt;Franvaro&gt; franvaron = franvaroService.hamtaAllaPagaendeOchNyaFriskskrivnaFranvaron(identitet.getPisaIds());
  
      if(franvaron.isEmpty()) {
          logger.debug("Inga pågende sjuk/vab anmälan");
          return ResponseEntity.noContent().build();
      }
      franvaron.forEach( franvaro -&gt; {
          ExternalFranvaroDTO externalFranvaroDTO = transformeraTillExternalFranvaroDTO(franvaro);
          externalFranvaroDTOLista.add(externalFranvaroDTO);
      });
  
      return ResponseEntity.ok().body(externalFranvaroDTOLista);
  }
  </code></pre>
  
  <p>Now I want to only use http security when I use @crossorigin</p>