Cross-Origin Resource Sharing with Spring Security

Question

I'm trying to make CORS play nicely with Spring Security but it's not complying. I made the changes described in this article and changing this line in `applicationContext-security.xml` has got POST and GET requests working for my app (temporarily exposes controller methods, so I can test CORS): - Before: `` - After: `` Unfortunately the following URL which allows Spring Security logins through AJAX isn't responding: `http://localhost:8080/mutopia-server/resources/j_spring_security_check`. I am making the AJAX request from `http://localhost:80` to `http://localhost:8080`. In Chrome When attempting to access `j_spring_security_check` I get `(pending)` in Chrome for the OPTIONS preflight request and AJAX call returns with HTTP status code 0 and message "error". In Firefox The preflight succeeds with HTTP status code 302 and I still get the error callback for my AJAX request direct…

Accepted Answer

I was able to do this by extending UsernamePasswordAuthenticationFilter... my code is in Groovy, hope that's OK:

```
public class CorsAwareAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
    static final String ORIGIN = 'Origin'

@Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response){
        if (request.getHeader(ORIGIN)) {
            String origin = request.getHeader(ORIGIN)
            response.addHeader('Access-Control-Allow-Origin', origin)
            response.addHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE')
            response.addHeader('Access-Control-Allow-Credentials', 'true')
            response.addHeader('Access-Control-Allow-Headers',
                    request.getHeader('Access-Control-Request-Headers'))
        }
        if (request.method == 'OPTIONS') {
            response.writer.print('OK')
            response.writer.flush()
            return
        }
        return super.attemptAuthentication(request, response)
    }
}
```

The important bits above:

- Only add CORS headers to response if CORS request detected

- Respond to pre-flight OPTIONS request with a simple non-empty 200 response, which also contains the CORS headers.

You need to declare this bean in your Spring configuration. There are many articles showing how to do this so I won't copy that here.

In my own implementation I use an origin domain whitelist as I am allowing CORS for internal developer access only. The above is a simplified version of what I am doing so may need tweaking but this should give you the general idea.

Cross-Origin Resource Sharing with Spring Security

Solution

Problem

Related problems