Combine global Spring Security CORS configuration with @CrossOrigin

Question

I am implementing CORS config for my application, where I use SpringSecurity for global configuration and also @CrossOrigin with stricter CORS rules than in my global configuration on a specific endpoint.

My @CrossOrigin annotated endpoint rule is ignored, allowing any cross-origin request to pass. However, my understanding is that at first Spring Security's CorsFilter should allow request and later some HandlerInterceptor should find @CrossOrigin annotation and performs second CORS check too.

Can those two CORS configuration be used together, or once I oped-in to Security CORS configuration I should setup everything there?

.cors(withDefaults())

@Bean
fun corsConfigurationSource(): CorsConfigurationSource {
    val source = UrlBasedCorsConfigurationSource()
 source.registerCorsConfiguration("/**", superPermissiveConfiguration())
    return source
}

@GetMapping("/set-csrf-cookie")
@ResponseStatus(HttpStatus.OK)
@CrossOrigin(origin = "https://<someURL>/") // UI application URL
fun setCsrfCookie(){}

I expect @CrossOrigin annotated endpoint will be checked after CorsFilter and overwrite the global configuration.

the rules for how the annotation works with global configuration is stated in the docs docs.spring.io/spring-framework/docs/current/javadoc-api/org/… they are additive, meaning local configuration will add onto the global one. — Toerktumlare
– Toerktumlare, Commented Mar 14 at 23:11

Shanmuga Sundaram Natarajan · Accepted Answer · 2025-03-14 00:11:35Z

-2

I see an issue because Spring Security takes full control of CORS once you enable http.cors(withDefaults()), which means @CrossOrigin on your controller gets ignored.

Option 1: Remove the global CORS config from Spring Security.

Option 2: Instead of using @CrossOrigin, configure CORS rules per endpoint.

answered Mar 14 at 0:11

Shanmuga Sundaram Natarajan

2411 gold badge2 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Combine global Spring Security CORS configuration with @CrossOrigin

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related