title: SPRING-SECURITY Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’
body: <p>I have my service work and deployed with no problem, but i need to add more feature <strong>[Realtime Notification]</strong>. I'm using <strong>SockJS</strong>, <strong>StompJS</strong>, <strong>Spring security</strong>, and <strong>LDAP authentication</strong>.</p>
  
  <p>Here is my <strong>AuthenticationFilter</strong>, i'm using token as my passcode it generated after login into LDAP.</p>
  
  <pre><code>@Log4j2
  public class AuthenticationFilter extends OncePerRequestFilter {
  
    @Autowired
    private JWTUtil jwtUtil;
  
    private final String authHeader = "token";
  
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
  
      //CORS
      response.addHeader("Access-Control-Allow-Origin", "*");
      if (request.getHeader("Access-Control-Request-Method") != null &amp;&amp; "OPTIONS".equalsIgnoreCase(request.getMethod())) {
          response.addHeader("Access-Control-Allow-Headers", "token");
          response.addHeader("Access-Control-Allow-Headers", "Content-Type");
          response.addHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
      }
  
      final String authHeader = request.getHeader(this.authHeader);
  
      if (authHeader != null) {
          String token = authHeader;
              try {
                  Claims claims = jwtUtil.getAllClaimsFromToken(token);
  
                  List&lt;SimpleGrantedAuthority&gt; authorities = new ArrayList&lt;&gt;();
  
                  UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
                      new User(claims.getSubject()),
                      null,
                      authorities
                  );
                  authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                  SecurityContextHolder.getContext().setAuthentication(authentication);
              } catch (Exception e) {
                  log.debug("Error ", e);
              }
      }
  
      if (!request.getMethod().equalsIgnoreCase("OPTIONS")) {
          chain.doFilter(request, response);
      }
    }
  }
  </code></pre>
  
  <p>Here is my <strong>WebSecurityConfig</strong></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
    @Bean
    public UnauthorizedHandler unauthorizedHandler() throws Exception {
      return new UnauthorizedHandler();
    }
  
    @Bean
    public ForbiddenHandler forbiddenHandler() throws Exception {
      return new ForbiddenHandler();
    }
  
    @Bean
    public AuthenticationFilter authenticationFilterBean() throws Exception {
      return new AuthenticationFilter();
    }
  
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
      httpSecurity
          // we don't need CSRF because our token is invulnerable
          .csrf().disable()
  
          .exceptionHandling().authenticationEntryPoint(unauthorizedHandler()).and()
          .exceptionHandling().accessDeniedHandler(forbiddenHandler()).and()
  
          // don't create session
          .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
  
          .authorizeRequests()
  
          // allow auth url
          .antMatchers("/login","/v2/api-docs", "/configuration/ui", "/swagger-resources/**", "/configuration/**", "/swagger-ui.html", "/webjars/**", "/notif/**", "/mealnotif/**", "/topic/**", "/websocket/**", "/resources/**", "/META-INF/resources/**").permitAll()
  
  
          .anyRequest().authenticated();
  
      // custom JWT based security filter
      httpSecurity.addFilterBefore(authenticationFilterBean(), UsernamePasswordAuthenticationFilter.class);
  
      // disable page caching
      httpSecurity.headers().cacheControl();
    }
  }
  </code></pre>
  
  <p>And the last one is my <strong>WebSocketConfig</strong></p>
  
  <pre><code>@Configuration
  @EnableWebSocketMessageBroker
  public class WebSocketConfig implements WebSocketMessageBrokerConfigurer {
  
    @Override
    public void configureMessageBroker(MessageBrokerRegistry config) {
      config.enableSimpleBroker("/topic");
      config.setApplicationDestinationPrefixes("/mealnotif");
    }
  
    @Override
    public void registerStompEndpoints(StompEndpointRegistry registry) {
      registry.addEndpoint("/notif").setAllowedOrigins("*")
              .withSockJS();
    }
  
  }
  </code></pre>
  
  <p>But in return My Angular project always return Cross-Origin Request Blocked</p>
  
  <p><a href="https://i.stack.imgur.com/mkPF7.png" rel="nofollow noreferrer">CORS Reason ERROR</a></p>
  
  <p>How do i solve this?</p>