Spring CORS No 'Access-Control-Allow-Origin' header is present

Question

I am getting the following problem after porting web.xml to java config

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:63342' is therefore not allowed access. 

Based on a few Spring references, the following attempt has been tried:

@Configuration @ComponentScan(basePackageClasses = AppConfig.class, useDefaultFilters = false, includeFilters = {         @Filter(org.springframework.stereotype.Controller.class) }) @EnableWebMvc public class WebConfig extends WebMvcConfigurerAdapter {      @Override     public void addCorsMappings(CorsRegistry registry) {         registry.addMapping("/*").allowedOrigins("*").allowedMethods("GET", "POST", "OPTIONS", "PUT")                 .allowedHeaders("Content-Type", "X-Requested-With", "accept", "Origin", "Access-Control-Request-Method",                         "Access-Control-Request-Headers")                 .exposedHeaders("Access-Control-Allow-Origin", "Access-Control-Allow-Credentials")                 .allowCredentials(true).maxAge(3600);     }  } 

The values chosen were taken from a working web.xml filter:

<filter>     <filter-name>CorsFilter</filter-name> <filter-class>org.apache.catalina.filters.CorsFilter</filter-class> <init-param>     <param-name>cors.allowed.origins</param-name>     <param-value>*</param-value> </init-param> <init-param>     <param-name>cors.allowed.methods</param-name>     <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value> </init-param> <init-param>     <param-name>cors.allowed.headers</param-name>     <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value> </init-param> <init-param>     <param-name>cors.exposed.headers</param-name>     <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value> </init-param> <init-param>     <param-name>cors.support.credentials</param-name>     <param-value>true</param-value> </init-param> <init-param>     <param-name>cors.preflight.maxage</param-name>     <param-value>10</param-value> </init-param> </filter> <filter-mapping>  <filter-name>CorsFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> 

Any ideas why the Spring java config approach is not working like the web.xml file did?

Answer 1

Change the CorsMapping from registry.addMapping("/*") to registry.addMapping("/**") in addCorsMappings method.

Check out this Spring CORS Documentation .

From the documentation -

Enabling CORS for the whole application is as simple as:

@Configuration @EnableWebMvc public class WebConfig extends WebMvcConfigurerAdapter {      @Override     public void addCorsMappings(CorsRegistry registry) {         registry.addMapping("/**");     } } 

You can easily change any properties, as well as only apply this CORS configuration to a specific path pattern:

@Configuration @EnableWebMvc public class WebConfig extends WebMvcConfigurerAdapter {     @Override     public void addCorsMappings(CorsRegistry registry) {         registry.addMapping("/api/**")             .allowedOrigins("http://domain2.com")             .allowedMethods("PUT", "DELETE")             .allowedHeaders("header1", "header2", "header3")             .exposedHeaders("header1", "header2")             .allowCredentials(false).maxAge(3600);     } } 

Controller method CORS configuration

@RestController @RequestMapping("/account") public class AccountController {   @CrossOrigin   @RequestMapping("/{id}")   public Account retrieve(@PathVariable Long id) {     // ...   } } 

To enable CORS for the whole controller -

@CrossOrigin(origins = "http://domain2.com", maxAge = 3600) @RestController @RequestMapping("/account") public class AccountController {      @RequestMapping("/{id}")     public Account retrieve(@PathVariable Long id) {         // ...     }      @RequestMapping(method = RequestMethod.DELETE, path = "/{id}")     public void remove(@PathVariable Long id) {         // ...     } } 

You can even use both controller-level and method-level CORS configurations; Spring will then combine attributes from both annotations to create merged CORS configuration.

@CrossOrigin(maxAge = 3600) @RestController @RequestMapping("/account") public class AccountController {      @CrossOrigin("http://domain2.com")     @RequestMapping("/{id}")     public Account retrieve(@PathVariable Long id) {         // ...     }      @RequestMapping(method = RequestMethod.DELETE, path = "/{id}")     public void remove(@PathVariable Long id) {         // ...     } } 

Answer 2

Helpful tip - if you're using Spring data rest you need a different approach.

@Component public class SpringDataRestCustomization extends RepositoryRestConfigurerAdapter {   @Override  public void configureRepositoryRestConfiguration(RepositoryRestConfiguration config) {     config.getCorsRegistry().addMapping("/**")             .allowedOrigins("http://localhost:9000");   } }