spring boot CORS filter along with spring security and OAuth2 (@EnableOAuth2Sso)

spring boot CORS filter along with spring security and OAuth2 (@EnableOAuth2Sso)

import org.springframework.stereotype.Component;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;



@Component
public class SimpleCrosFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
        response.setHeader("Access-Control-Allow-Credentials", "true");
        response.setHeader("Access-Control-Allow-Methods", "*");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "*");
        response.setHeader("Access-Control-Allow-Headers", "authorization, content-type, xsrf-token");
        response.addHeader("Access-Control-Expose-Headers", "xsrf-token");

                if ("OPTIONS".equals(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);

        } else {
                    chain.doFilter(req, res);
        }



    }

    @Override
    public void destroy() {

    }
}



spring security filter : here the key thing is you have to permitall preflight request by adding requestMatchers(CorsUtils::isPreFlightRequest).permitAll()


            http
                    .antMatcher("/**").authorizeRequests().requestMatchers(CorsUtils::isPreFlightRequest).permitAll().antMatchers("/","/user**", "/login**", "/webjars/**" )
                    .permitAll().anyRequest()
                    .authenticated().and().exceptionHandling()
                    .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/")).and().logout()
                    .logoutSuccessUrl("/").permitAll().and()
                    .csrf().disable()
                    .addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class);