Resolving Spring CORS Configuration Issues in Java-Based Setup

Introduction

When migrating Spring MVC configurations from traditional web.xml to Java-based configurations, developers often encounter issues with Cross-Origin Resource Sharing (CORS). A common error is the absence of the 'Access-Control-Allow-Origin' header, which prevents browsers from accessing resources across different origins. This article addresses this problem by analyzing the root cause and providing effective solutions.

Understanding CORS

CORS is a security feature implemented by browsers to restrict cross-origin HTTP requests. It requires servers to include specific headers in responses to allow or deny requests from different origins. In Spring, CORS can be configured globally or at the controller level.

Error Analysis

In the provided scenario, the user attempted to configure CORS using registry.addMapping("/*") in a WebMvcConfigurer implementation. However, this path pattern only matches direct paths and does not cover subpaths, leading to the CORS headers not being applied to all requests. The correct pattern should be "/**", which matches all paths recursively.

Solution: Using "/**" in CorsRegistry

To resolve this, change the mapping to registry.addMapping("/**"). This ensures that CORS headers are added to all endpoints. Below is a revised code example based on Spring best practices:

@Configuration
@EnableWebMvc
public class WebConfig implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
            .allowedOrigins("*")
            .allowedMethods("GET", "POST", "OPTIONS", "PUT")
            .allowedHeaders("Content-Type", "X-Requested-With", "accept", "Origin", "Access-Control-Request-Method", "Access-Control-Request-Headers")
            .exposedHeaders("Access-Control-Allow-Origin", "Access-Control-Allow-Credentials")
            .allowCredentials(true)
            .maxAge(3600);
    }
}

This configuration allows all origins, methods, and headers as specified, and includes credentials support with a max age of 3600 seconds.

Advanced CORS Configuration

Spring provides multiple ways to configure CORS. In addition to global configuration, you can use annotations at the controller or method level. For example, using @CrossOrigin on a controller method:

@RestController
public class MyController {

    @CrossOrigin(origins = "http://localhost:9000")
    @GetMapping("/api/data")
    public String getData() {
        return "Data";
    }
}

This enables CORS only for the specific method, with restricted origins. You can combine global and fine-grained configurations for flexible control.

Comparison with web.xml Configuration

In web.xml, CORS was often configured using filters like org.apache.catalina.filters.CorsFilter. The Java configuration in Spring offers a more integrated and type-safe approach. For instance, the allowed methods and headers can be directly specified without XML, reducing configuration errors.

Conclusion

Migrating CORS configurations to Java-based Spring setups requires attention to path patterns. Using "/**" instead of "/*" ensures comprehensive coverage. By leveraging Spring's CORS support, developers can build secure and interoperable web services efficiently.