CODEWITHSUNDEEP
javaspringspring-mvcservletscors
maslan
maslan

Reputation: 2178

Spring MVC 4.2+ CORS returning 403

I have created a fresh and simple Spring MVC application (used 4.2.1.Release, now switched to 4.2.7.Release). The app is simple:

WEB.XML:

<servlet>
        <servlet-name>proxy</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>

    <init-param>
        <param-name>dispatchOptionsRequest</param-name>
        <param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath*:my-cool-context.xml</param-value>
    </init-param>        
</servlet>
<servlet-mapping>   
    <servlet-name>proxy</servlet-name>
    <url-pattern>/*</url-pattern>
</servlet-mapping>

Context:

<context:component-scan base-package="my.supercool.company.app"/>
<mvc:cors>
    <mvc:mapping path="/**" allowed-methods="POST, OPTIONS" />
</mvc:cors>

And the controller

@Controller
@RequestMapping("/")
@CrossOrigin
public class MySupercoolController {
    @CrossOrigin
    @RequestMapping(path="test", method = RequestMethod.POST)
    @ResponseBody   
    private ResponseEntity<String> executePostProxy(HttpServletRequest request){
         return new ResponseEntity<String>("TEST", HttpStatus.OK);
    }
}

Now - the controller itself is working and returns my text, so the controller is loaded into context. But the preflightRequest for that endpoint is getting 403 Forbidden response, and the CORS response heaeders are not set. I am using JBOSS, but I have verified that the OPTIONS request get to Spring (the FrameworkServlet doOptions method is being executed, checked via debugger). Is there anything else I should configure for CORS in spring MVC?

BTW The context CORS config and Annotation config - I tried to make it work so I tried with xml, annotations and both.

Upvotes: 2

Views: 1392

Answers (1)

maslan
maslan

Reputation: 2178

It appears, that this is also necessary:

@Configuration
@EnableWebMvc
public class WebConfig extends WebMvcConfigurerAdapter {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**");
    }
}

Upvotes: 2

Related Questions