19. CORS
Prev | Part IV. Web Application Security | Next

## 19. CORS

Spring Framework provides first class support for CORS. CORS must be processed before Spring Security because the pre-flight request will not contain any cookies (i.e. the `JSESSIONID`). If the request does not contain any cookies and Spring Security is first, the request will determine the user is not authenticated (since there are no cookies in the request) and reject it.

The easiest way to ensure that CORS is handled first is to use the `CorsFilter`. Users can integrate the `CorsFilter` with Spring Security by providing a `CorsConfigurationSource` using the following:

    @EnableWebSecurity
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    	@Override
    	protected void configure(HttpSecurity http) throws Exception {
    		http
    			// by default uses a Bean by the name of corsConfigurationSource
    			.cors().and()
    			...
    	}

    	@Bean
    	CorsConfigurationSource corsConfigurationSource() {
    		CorsConfiguration configuration = new CorsConfiguration();
    		configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
    		configuration.setAllowedMethods(Arrays.asList("GET","POST"));
    		UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    		source.registerCorsConfiguration("/**", configuration);
    		return source;
    	}
    }

or in XML

    <http>
    	<cors configuration-source-ref="corsSource"/>
    	...
    </http>
    <b:bean id="corsSource" class="org.springframework.web.cors.UrlBasedCorsConfigurationSource">
    	...
    </b:bean>

If you are using Spring MVC’s CORS support, you can omit specifying the `CorsConfigurationSource` and Spring Security will leverage the CORS configuration provided to Spring MVC.

    @EnableWebSecurity
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    	@Override
    	protected void configure(HttpSecurity http) throws Exception {
    		http
    			// if Spring MVC is on classpath and no CorsConfigurationSource is provided,
    			// Spring Security will use CORS configuration provided to Spring MVC
    			.cors().and()
    			...
    	}
    }

or in XML

    <http>
    	<!-- Default to Spring MVC's CORS configuration -->
    	<cors />
    	...
    </http>

Prev | Up | Next
18. Cross Site Request Forgery (CSRF) | Home | 20. Security HTTP Response Headers