title: CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status
body: <p>I am using Angular6 as FrontEnd running on <b>http:// localhost:4200</b> and Spring Boot (which has in built Tomcat server) as backend (exposing a GET Rest API) running on <b>https:// localhost:8083/ldap</b>   . When I run this, I am getting CORS policy error on the browser. So I searched on internet and tried multiple fixes which were suggested on internet. I am not sure what I am missing on each of the solution below.</p>
  
  <p><br>
  <b>Unsuccessful Fix 1:</b> I tried to run it via proxy.<br>
  -> Created a proxy.config.json in parallel to package.json with below
     content.<br>
  {<br>
     &nbsp;&nbsp; "/ldap/<em>": {<br>
     &nbsp;&nbsp; "target": "<a href="https://localhost:8083" rel="nofollow noreferrer">https://localhost:8083</a>",<br>
     &nbsp;&nbsp; "secure": false,<br>
     &nbsp;&nbsp; "logLevel": "debug",<br>
     &nbsp;&nbsp; "changeOrigin": true<br>
      &nbsp;}<br>
  }<br>
  -> Added below entry in package.json inside script block there.<br>
     <b>"start":"ng serve --proxy-config proxy.config.json",</b><br>
  <br>
  -> In the service class, tried calling my spring boot backend rest API 
     like below.<br>
     <b>return this.http.get('/ldap');</b> <br>
  Now when I run my app, I got below error:<br><br>
  GET http:// localhost:4200/ldap 404 (Not Found) : zone.js:3243 <br>
  <br><br>
  <b>Unsuccessful Fix 2:</b> I added below headers before calling the Rest API in my frontend.<br>
  getUserAuthenticatedFromLDAP() {<br>
          &nbsp; const httpOptions = {<br>&nbsp;
          &nbsp; headers: new HttpHeaders({<br>&nbsp;
          &nbsp; 'crossDomain': 'true',<br>&nbsp;
          &nbsp; 'mode' : 'cors',<br>&nbsp;
                   &nbsp; 'allowCredentials': 'true',<br>&nbsp;
              &nbsp;      'origins': '</em>',<br>&nbsp;
              &nbsp;      'allowedHeaders': '<em>',<br>&nbsp;
              &nbsp;      'Access-Control-Allow-Origin': '</em>',<br>&nbsp;
              &nbsp;      'Access-Control-Allow-Methods': 'GET',<br>&nbsp;
              &nbsp;      'Access-Control-Allow-Headers': 'Origin, X-Requested-With, Content-Type, Accept',<br>&nbsp;
               &nbsp;     'Access-Control-Max-Age': '86400'<br>&nbsp;
  <br>&nbsp;
            &nbsp;    })<br>&nbsp;
         &nbsp;   };<br>&nbsp;
  <br>&nbsp;
       &nbsp;   return this.http.get('<a href="https://localhost:8083" rel="nofollow noreferrer">https://localhost:8083</a>' , httpOptions);<br>
    }<br>&nbsp;<br> </p>
  
  <p><b><i>Access to XMLHttpRequest at '<a href="https://localhost:8083/" rel="nofollow noreferrer">https://localhost:8083/</a>' from origin '<a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.</b></i><br><br></p>
  
  <p><b>Unsuccessful Fix 3:</b> Rather than making changes at front end, I tried to make changes at API level by adding below code at controller level.<br></p>
  
  <p>@Controller<br>
  @CrossOrigin(origins = "<a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a>")<br>
  public class WelcomeController {</p>
  
  <pre><code>// This is for LDAP Authentication
  @GetMapping("/ldap")
  @ResponseBody
  public Authentication hello() {
      return LdapSecurity.getAuthentication();
  }
  </code></pre>
  
  <p>}</p>
  
  <p>Here I am getting below error again:</p>
  
  <p><b><i>Access to XMLHttpRequest at '<a href="https://localhost:8083/" rel="nofollow noreferrer">https://localhost:8083/</a>' from origin '<a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.</i></b> <br><br></p>
  
  <p>More unsuccessful fixes:</p>
  
  <p>I even tried to change headers of Tomcat using application.properties file but could not find sufficient example or piece of code to make any change.<br>
  On internet, some people suggested to implement filter on API level but I am not sure that in whcih class I need to add those overriden filter method. <br> I am stuck in this issue for last 2 days.
  <br><br>
  PS: I see some people have implemented CORS filter at API layer or implemented class like below. Now my question is if I implement below class then where do I need to refer this class ? Is it web.xml or any other place. <br><br></p>
  
  <p>@Configuration &nbsp;
  @EnableWebSecurity &nbsp;<br>
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter { &nbsp;</p>