CORS done right

Key points

• CORS is a browser rule, not server protection. It decides whether JS on one origin may read a response from another.
• Anything non-simple triggers a preflight OPTIONS. It carries no credentials, so it must pass before authentication.
• Configure it in the chain: cors(Customizer.withDefaults()) picks up your CorsConfigurationSource bean.
• @CrossOrigin on a controller is too late if the chain rejects the preflight first. Prefer one central config.
• allowCredentials(true) forbids *. List exact origins, or use allowedOriginPatterns for wildcards.

Example

@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration cfg = new CorsConfiguration();
    cfg.setAllowedOrigins(List.of("https://app.example.com"));
    cfg.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
    cfg.setAllowedHeaders(List.of("Authorization", "Content-Type"));
    cfg.setAllowCredentials(true);
    cfg.setMaxAge(Duration.ofMinutes(30));   // cache the preflight

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/api/**", cfg);
    return source;
}

// in the SecurityFilterChain
http.cors(Customizer.withDefaults());

CORS belongs in the security chain — otherwise the preflight dies before your rules run.