Spring CORS Configuration Examples

CORS (Cross-origin resource sharing) allows a webpage to request additional resources into browser from other domains e.g. fonts, CSS or static images from CDNs. CORS helps in serving web content from multiple domains into browsers who usually have the same-origin security policy. In this example, we will learn to enable CORS support in Spring MVC application at method and global level.

Read More: Java CORS Filter Example

Table of Contents

Method level CORS with @CrossOrigin
Global CORS Configuration

Method level CORS with @CrossOrigin

Spring MVC provides @CrossOrigin annotation. This annotation marks the annotated method or type as permitting cross origin requests.

By default, @CrossOrigin allows all origins, all headers, the HTTP methods specified in the @RequestMapping annotation and a maxAge of 30 minutes. You can override these settings giving value to annotation attributes :

@CrossOrigin at Class/Controller Level

@CrossOrigin(origins = "*", allowedHeaders = "*")
@Controller
public class HomeController 
{
	@GetMapping(path="/")
	public String homeInit(Model model) {
		return "home";
	}
}

Read More – Spring 5 MVC Example

@CrossOrigin at Method Level

@Controller
public class HomeController 
{
	@CrossOrigin(origins = "*", allowedHeaders = "*")
	@GetMapping(path="/")
	public String homeInit(Model model) {
		return "home";
	}
}

@CrossOrigin Overridden at Method Level

homeInit() method will be accessible only from domain http://example.com. Rest other methods in HomeController will be accessible from all domains.

@Controller
@CrossOrigin(origins = "*", allowedHeaders = "*")
public class HomeController 
{
	@CrossOrigin(origins = "http://example.com")
	@GetMapping(path="/")
	public String homeInit(Model model) {
		return "home";
	}
}

Global CORS Configuration

Spring MVC CORS with WebMvcConfigurerAdapter

To enable CORS for the whole application, use WebMvcConfigurerAdapter to add CorsRegistry.

@Configuration
@EnableWebMvc
public class CorsConfiguration extends WebMvcConfigurerAdapter 
{
	@Override
	public void addCorsMappings(CorsRegistry registry) {
		registry.addMapping("/**")
				.allowedMethods("GET", "POST");
	}
}

Spring Boot CORS with WebMvcConfigurer

In spring boot application, it is recommended to just declare a WebMvcConfigurer bean.

@Configuration
public class CorsConfiguration 
{
    @Bean
    public WebMvcConfigurer corsConfigurer() 
    {
        return new WebMvcConfigurerAdapter() {
            @Override
            public void addCorsMappings(CorsRegistry registry) {
                registry.addMapping("/**");
            }
        };
    }
}

CORS with Spring Security

To enable CORS support through Spring security, configure CorsConfigurationSource bean and use HttpSecurity.cors() configuration.

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.cors().and()
			//other config
	}

	@Bean
	CorsConfigurationSource corsConfigurationSource() 
	{
		CorsConfiguration configuration = new CorsConfiguration();
		configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
		configuration.setAllowedMethods(Arrays.asList("GET","POST"));
		UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
		source.registerCorsConfiguration("/**", configuration);
		return source;
	}
}

Drop me your questions in comments section.

Happy Learning !!