Spring Boot CORS Configuration Examples

CORS (Cross-Origin Resource Sharing) is a browser mechanism that enforces the ‘same-origin‘ policy to protect web applications from potential security threats. When used, CORS allows a webpage to request additional resources into the browser from other domains, such as API data using AJAX, font files, style sheets etc.

We need CORS because modern browsers usually have the same-origin security policy (browsers prohibit AJAX calls to resources outside the current origin). If a cross-origin request violates the same-origin policy and is not permitted by the server’s CORS headers, the browser blocks the request and triggers a CORS error in JavaScript.

In this tutorial, we will learn to enable CORS support in Spring Boot applications at the method level as well as at the global level.

See Also: Creating a CORS Filter using javax.servlet.Filter

1. Different Ways to Apply CORS in Spring Boot?

There are typically the following three ways to apply the CORS on a Spring Boot application:

1. Using @CrossOrigin annotation at @Controller class and method level. It allows controlling the CORS configuration at the “method level”.
2. Overriding CorsRegistry on WebMvcConfigurer bean. It allows the definition of the CORS configuration at the “global level” and applies to methods from multiple controllers using the path patterns.
3. Configure the CORS settings using Spring security’s http.cors() method.

Let us learn each method in detail.

2. Method Level CORS with @CrossOrigin

2.1. @CrossOrigin Annotation

Spring MVC provides @CrossOrigin annotation that marks the annotated method or type as permitting cross-origin requests.

@CrossOrigin
@GetMapping("/{id}")
public Record retrieve(@PathVariable Long id) { ... }

By default, @CrossOrigin allows:

• all origins
• all headers
• all HTTP methods specified in the @RequestMapping annotation
• maxAge of 30 minutes

To customize the behavior, the annotation supports the following attributes:

• origins: list of allowed origins. Its value is placed in the Access-Control-Allow-Origin header of both pre-flight and actual responses. The“*” or undefined (default) means that all origins are allowed.
• allowedHeaders: list of request headers that can be used during the actual request. Its value is used in the preflight’s Access-Control-Allow-Headers response header. The “*” or undefined (default) means that all headers requested by the client are allowed.
• methods: list of supported HTTP request methods. If undefined (default), methods defined by @RequestMapping are used.
• exposedHeaders: list of response headers that the browser will allow the client to access. By default, it is an empty list.
• allowCredentials: determines whether the browser should include any cookies associated with the request. By default, credentials are allowed.
• maxAge: refers to the maximum age (in seconds) of the cache duration for the pre-flight response’s Access-Control-Max-Age header. The default is 1800 seconds or 30 minutes.

@CrossOrigin(origins = "*", allowedHeaders = "*")

2.2. @CrossOrigin on Controller Class

When applied on the @Controller class top, CORS configuration is applied to each handler method in that class.

In the following example, CORS configuration is applicable to both handler methods.

@CrossOrigin(origins = "*", allowedHeaders = "*")
@RestController("/records")
public class HomeController {

  @GetMapping("/{id}")  
  public Record retrieve(@PathVariable Long id) { ... }

  @PostMapping("/")  
  public ResponseEntity create(@RequestBody Record record) { ... }
}

2.2. @CrossOrigin on Controller Class and Handler Method

We can apply the CORS config at the class level and method level as well. When applied in both places, configuration at the method level takes priority.

@CrossOrigin(origins = "*", allowedHeaders = "*")
@RestController("/records")
public class HomeController {

  @GetMapping("/{id}")  
  @CrossOrigin(origins = "*")
  public Record retrieve(@PathVariable Long id) { ... }

  //...
}

3. Global CORS Configuration with CorsRegistry

To avoid repeating the same configuration over each handler method, we can configure some of the CORS configurations at the global level and then set URL-based CorsConfiguration mappings individually on any handler method.

By default, global configuration enables the following:

• All origins.
• All headers.
• GET, HEAD, and POST methods.
• maxAge set to 30 minutes.

3.1. Using CorsRegistry Callback

To enable CORS for the whole application, use WebMvcConfigurer to add CorsRegistry.

@Configuration
@EnableWebMvc
public class WebConfig implements WebMvcConfigurer {

  @Override
  public void addCorsMappings(CorsRegistry registry) {

    registry.addMapping("/api/**")
      .allowedOrigins("https://example.com")
      .allowedMethods("GET", "POST")
      .allowedHeaders("header1", "header2", "header3")
      .exposedHeaders("header1", "header2")
      .allowCredentials(true).maxAge(3600);

    // Add more mappings...
  }
}

3.2. Using WebMvcConfigurer Bean

In the Spring boot applications, it is recommended to just declare a WebMvcConfigurer bean.

@Configuration
public class WebConfig
{
    @Bean
    public WebMvcConfigurer corsConfigurer()
    {
        return new WebMvcConfigurer() {
            @Override
            public void addCorsMappings(CorsRegistry registry) {
                registry.addMapping("/**").allowedOrigins("http://localhost:8080");
            }
        };
    }
}

4. CORS with Spring Security

To enable default CORS support through Spring security, use HttpSecurity.cors() method.

@EnableWebSecurity
public class WebSecurityConfig {

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.cors().and()...
    //other config
  }
}

@EnableWebSecurity
public class WebSecurityConfig {

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
      http.cors().and()...
      //other config
  }
}

To customize the CORS settings, we can supply the CorsConfigurationSource bean as follows:

@EnableWebSecurity
public class WebSecurityConfig {

	//...

	@Bean
	CorsConfigurationSource corsConfigurationSource() {

		CorsConfiguration configuration = new CorsConfiguration();
		configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
		configuration.setAllowedMethods(Arrays.asList("GET","POST"));
		UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
		source.registerCorsConfiguration("/**", configuration);
		return source;
	}
}

Drop me your questions in the comments section.

Happy Learning !!

Sourcecode on Github