How to Properly Configure CORS in a Spring Boot Application with Spring Security?

Configuring CORS in a Spring Boot Spring Security Application

Problem

Integrating CORS support into a Spring Boot application configured with Spring Security can result in unexpected CORS-related issues. Specifically, when using AngularJS or JavaScript XMLHttpRequests, status codes like "0" or empty response bodies can be encountered when authentication fails, hindering proper error handling at the frontend.

Solution

To resolve this issue, explicitly enable CORS support in Spring Security:

1. Enable CORS support in Spring Security:

   @EnableWebSecurity
   public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http.cors().and()... // Add additional security configuration here
       }
   }

   Copy after login

2. Utilize CORS global configuration (optional):

   Define a CorsConfigurationSource bean:

   @Bean
   CorsConfigurationSource corsConfigurationSource() {
       UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
       source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
       return source;
   }

   Copy after login

This configuration leverages Spring MVC's CORS support and addresses previous filter-based approaches. More details can be found in the Spring Security CORS documentation.

Additional Notes

• The issue arises when Spring Security redirects or fails to add CORS headers during the authentication process.
• Enabling Spring Security CORS support allows the framework to leverage Spring MVC's CORS configuration.
• Controller-level @CrossOrigin annotations are supported when Spring Security CORS support is enabled.
• If authentication fails, the response will contain the appropriate status code and body, facilitating proper error handling in the frontend.

The above is the detailed content of How to Properly Configure CORS in a Spring Boot Application with Spring Security?. For more information, please follow other related articles on the PHP Chinese website!