title: spring security oauth2 Authorization Basic preflight error
body: <p>I have a problem with spring security oauth2. I have everything working as expected except for CORS when having HTTP Basic Authorization. When Basic Auth is loaded, browser sends OPTIONS request to my endpoint. However, I get an error:</p>
  
  <blockquote>
    <p>Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.</p>
  </blockquote>
  
  <p>Here is my code (I am using Annotations):</p>
  
  <pre><code>public class AppInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
  
      @Override
      protected Class&lt;?&gt;[] getRootConfigClasses() {
          return new Class[] { AppConfiguration.class };
      }
  
      @Override
      protected Class&lt;?&gt;[] getServletConfigClasses() {
          return null;
      }
  
      @Override
      protected String[] getServletMappings() {
          return new String[] { "/*" };
      }
  
      @Override
      protected Filter[] getServletFilters() {
         CharacterEncodingFilter encodingFilter = new CharacterEncodingFilter();
         encodingFilter.setForceEncoding(true);
         encodingFilter.setEncoding("UTF-8");
         return new Filter[]{encodingFilter,
                 new DelegatingFilterProxy("springSecurityFilterChain"),
                 new CORSFilter() };
      } 
  }
  
  // CORS
  
  public class CORSFilter implements Filter {
  
          @Override
      public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
              System.out.println("Filtering on...........................................................");
              HttpServletResponse response = (HttpServletResponse) res;
              response.setHeader("Access-Control-Allow-Origin", "*");
              response.setHeader("Access-Control-Allow-Credentials", "true");
              response.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, OPTIONS, DELETE");
              response.setHeader("Access-Control-Max-Age", "3600");
              response.setHeader("Access-Control-Allow-Headers", "X-Requested-With, Content-Type, Authorization, Origin, Accept, Access-Control-Request-Method, Access-Control-Request-Headers");
  
              chain.doFilter(req, res);
      }
  
          @Override
          public void init(FilterConfig filterConfig) throws ServletException {
  
          }
  
          @Override
          public void destroy() {
  
          }
  
  }
  </code></pre>
  
  <p>OAuth2ServerConfiguration:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      // other stuff...
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
           .csrf().disable()
           .authorizeRequests().antMatchers("/oauth/**", "/kiosks").permitAll().and().httpBasic();
      }
  }
  </code></pre>
  
  <p>Every other basic HTTP requests work (by basic I mean the ones that don't need preflight OPTIONS requests). CORS is allowed as any other. Basic Auth ones don't work though.</p>
  
  <p>I want to mention that I have tested every type of solution (from Google and StackOverflow) to make this thing work but I have not even gotten close to fixing the problem.</p>
  
  <p>What am I missing here?</p>