SpringBoot 2 Migration Issue with CORS support

[pluttrell]

Using SpringBoot 1.5.9 with this controller and configuration, CORS requests are allowed (work fine):

@CrossOrigin
@RestController
public class SampleController {
  @GetMapping(path = "mypath")
  public String something() {
      return "foobar";
  }
}

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf().disable()
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
        .authorizeRequests()
        .antMatchers("/**").permitAll();
  }
}

However when I migrated to SpringBoot v2.0.0, with the same controller and configration I now get errors in the latest version of Chrome to the same previously working requests:

Failed to load https://gateway.mydomain.com/mypath: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'https://spa.mydomain.com' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

Per this possibly dated StackOverflow answer, I've tried using this updated configuration, but that still does not work:

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
        .cors()
        .and()
        .csrf().disable()
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
        .authorizeRequests()
        .antMatchers("/**").permitAll();
  }

  @Bean
  CorsConfigurationSource corsConfigurationSource() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
    return source;
  }

}

How do we get the same CORS functionality possible out of the box with SpringBoot 1.5.9 in SpringBoot 2?

Is there a better way to resolve this without specifying the origin domain?

[wilkinsona]

This is due to the change made in Spring Framework for SPR-16130. allowCredentials now defaults to false which affects this logic in CorsConfiguration:

		if (this.allowedOrigins.contains(ALL)) {
			if (this.allowCredentials != Boolean.TRUE) {
				return ALL;
			}
			else {
				return requestOrigin;
			}
		}

You can restore the behaviour of Spring Framework 4.3 and Spring Boot 1.5 by changing your @CrossOrigin annotation:

@CrossOrigin(allowCredentials="true")

/cc @sdeleuze

[pluttrell]

@wilkinsona Many thanks for the insight. Since it’s a change to the default, it might be a good addition to the migration guide.

[wilkinsona]

Thanks for the suggestion. If it's mentioned anywhere, I think it should probably go in Spring Framework's upgrade documentation. What do you think, @sdeleuze?

[sdeleuze]

Good idea, I have added a CORS support section in Spring Framework 5 upgrade documentation.

[wilkinsona]

Thanks, @sdeleuze. I've also added a link in Boot's migration guide to Framework's upgrade documentation.

[dyunusemre]

@wilkinsona you saved my day thanks alot