Spring: CORS is a filter and runs before your controller

A missing origin means a 403 with an empty body that never reaches your code - and looks like a bug in the endpoint.

Code

@Bean
CorsConfigurationSource corsSource() {
    var config = new CorsConfiguration();
    config.setAllowedOrigins(List.of("https://example.com"));
    config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
    config.setAllowedHeaders(List.of("*"));
    config.setAllowCredentials(true);

    var source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/api/**", config);
    return source;
}

Output

curl -X OPTIONS ... -H "Origin: https://example.com"  -> 200
curl -X OPTIONS ... -H "Origin: https://other.com"    -> 403 (empty body)

Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.

Published 2026-08-11