CORS configuration in Security in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CORS stand for and why is it important in web security?

CORS stands for Cross-Origin Resource Sharing. It is important because it controls how resources on a web server can be requested from another domain, helping to prevent unauthorized access and security risks.

intermediate

How do you enable CORS in a Spring Boot Security configuration?

You enable CORS by configuring a CorsConfigurationSource bean and applying it in the HttpSecurity object using .cors(). This allows you to specify allowed origins, methods, headers, and credentials.

intermediate

What is the role of the CorsConfigurationSource bean in Spring Security?

CorsConfigurationSource defines the CORS settings like allowed origins, methods, headers, and credentials. Spring Security uses it to apply these rules to incoming requests.

advanced

Why should CORS be configured carefully in a security context?

Because incorrect CORS settings can allow malicious websites to access sensitive data or perform unwanted actions on behalf of a user, leading to security vulnerabilities.

intermediate

Show a simple example of enabling CORS for all origins in Spring Security.

In your SecurityFilterChain bean, add .cors().configurationSource(request -> { var cors = new CorsConfiguration(); cors.setAllowedOriginPatterns(List.of("*")); cors.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE")); return cors; });

What does the .cors() method do in Spring Security configuration?

A Disables all security filters

B Enables Cross-Origin Resource Sharing support

C Configures database connections

D Sets up user authentication

The .cors() method enables CORS support in Spring Security, allowing you to define cross-origin rules.

Which bean is commonly used to define CORS settings in Spring Boot Security?

A CorsConfigurationSource

B DataSource

C PasswordEncoder

D AuthenticationManager

CorsConfigurationSource bean defines the CORS rules like allowed origins and methods.

What could happen if you set allowed origins to '*' in production without restrictions?

A It disables CORS completely

B It improves security by blocking all requests

C It may expose your API to security risks

D It only allows requests from localhost

Allowing all origins can let any website access your API, which can be a security risk.

Which HTTP methods should you specify in CORS configuration to allow data modification?

A POST, PUT, DELETE

B GET only

C HEAD only

D OPTIONS only

POST, PUT, and DELETE methods are used to create, update, or delete data and should be allowed if needed.

Where do you typically apply the CORS configuration in Spring Security?

A In the database schema

B In the application.properties file

C In the main method

D In the HttpSecurity configuration using .cors()

CORS is configured in the HttpSecurity object by calling .cors() and providing a CorsConfigurationSource.

Explain how to configure CORS in Spring Security and why it is important.

Think about how browsers restrict cross-domain requests and how Spring Security helps manage that.

Describe potential security risks if CORS is misconfigured in a Spring Boot application.

Consider what happens if any website can call your API without limits.

Practice

1. What is the main purpose of configuring CORS in a Spring Boot security setup?

easy

A. To control which external websites can access your backend resources

B. To improve database query performance

C. To manage user authentication tokens

D. To style the frontend user interface

Solution

1. Step 1: Understand CORS role in web security

   CORS (Cross-Origin Resource Sharing) controls which external domains can call your backend APIs.

2. Step 2: Identify the purpose in Spring Boot security

   Configuring CORS in Spring Security allows safe cross-site requests by specifying allowed origins and methods.

3. Final Answer:

   To control which external websites can access your backend resources -> Option A

4. Quick Check:

   CORS controls access origins = A [OK]

Hint: CORS = Cross-Origin access control [OK]

Common Mistakes:

• Confusing CORS with authentication
• Thinking CORS improves database speed
• Assuming CORS styles frontend

2. Which of the following is the correct way to enable CORS in a Spring Security configuration class?

easy

A. http.corsEnabled(true);

B. http.enableCors();

C. http.allowCors(true);

D. http.cors().and().csrf().disable();

Solution

1. Step 1: Recall Spring Security CORS enabling syntax

   Spring Security uses the method http.cors() to enable CORS support.

2. Step 2: Identify the correct chaining method

   The correct chaining to disable CSRF and enable CORS is http.cors().and().csrf().disable();

3. Final Answer:

   http.cors().and().csrf().disable(); -> Option D

4. Quick Check:

   Enable CORS with http.cors() = C [OK]

Hint: Use http.cors() to enable CORS in Spring Security [OK]

Common Mistakes:

• Using non-existent methods like enableCors()
• Forgetting to chain with .and()
• Confusing CORS enabling with CSRF

3. Given this Spring Security CORS configuration snippet, what origins are allowed?

@Bean
public CorsConfigurationSource corsConfigurationSource() {
  CorsConfiguration configuration = new CorsConfiguration();
  configuration.setAllowedOrigins(List.of("https://example.com", "https://app.example.com"));
  configuration.setAllowedMethods(List.of("GET", "POST"));
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  source.registerCorsConfiguration("/**", configuration);
  return source;
}

medium

A. No origins are allowed because configuration is incomplete

B. Requests from any origin are allowed

C. Only requests from https://example.com and https://app.example.com are allowed

D. Only GET requests from any origin are allowed

Solution

1. Step 1: Analyze allowed origins list

   The code sets allowed origins explicitly to "https://example.com" and "https://app.example.com".

2. Step 2: Understand effect on requests

   Only requests coming from these two origins will be accepted; others will be blocked by CORS policy.

3. Final Answer:

   Only requests from https://example.com and https://app.example.com are allowed -> Option C

4. Quick Check:

   Allowed origins = example.com and app.example.com = D [OK]

Hint: Allowed origins list controls which sites can call backend [OK]

Common Mistakes:

• Assuming all origins allowed by default
• Confusing allowed methods with allowed origins
• Thinking configuration is incomplete without headers

4. Identify the error in this Spring Security CORS configuration code:

@Bean
public CorsConfigurationSource corsConfigurationSource() {
  CorsConfiguration configuration = new CorsConfiguration();
  configuration.setAllowedOrigins("*");
  configuration.setAllowedMethods(List.of("GET", "POST"));
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  source.registerCorsConfiguration("/**", configuration);
  return source;
}

medium

A. Allowed methods list is missing PUT and DELETE

B. setAllowedOrigins expects a list, not a single string

C. UrlBasedCorsConfigurationSource cannot be used here

D. The method should return void, not CorsConfigurationSource

Solution

1. Step 1: Check setAllowedOrigins parameter type

   The method setAllowedOrigins requires a List<String>, but the code passes a single String "*".

2. Step 2: Understand correct usage for wildcard

   To allow all origins, use List.of("*") instead of a plain string.

3. Final Answer:

   setAllowedOrigins expects a list, not a single string -> Option B

4. Quick Check:

   Allowed origins must be List<String> = B [OK]

Hint: setAllowedOrigins needs a list, not a string [OK]

Common Mistakes:

• Passing a string instead of a list to setAllowedOrigins
• Ignoring method parameter types
• Assuming missing HTTP methods cause errors here

5. You want to allow all origins but only GET and POST methods in your Spring Security CORS config. Which code snippet correctly achieves this while following best practices?

hard

A. configuration.setAllowedOriginPatterns(List.of("*")); configuration.setAllowedMethods(List.of("GET", "POST"));

B. configuration.setAllowedOrigins(List.of("*")); configuration.setAllowedMethods(List.of("GET", "POST"));

C. configuration.setAllowedOrigins("*"); configuration.setAllowedMethods(List.of("GET", "POST"));

D. configuration.setAllowedOrigins(List.of("*")); configuration.setAllowedMethods(List.of("GET", "POST", "PUT"));

Solution

1. Step 1: Understand wildcard origin allowance

   Using setAllowedOrigins(List.of("*")) is deprecated and may cause issues; instead, setAllowedOriginPatterns supports wildcards properly.

2. Step 2: Check allowed methods correctness

   Only GET and POST methods are allowed as required.

3. Final Answer:

   configuration.setAllowedOriginPatterns(List.of("*")); configuration.setAllowedMethods(List.of("GET", "POST")); -> Option A

4. Quick Check:

   Use allowedOriginPatterns for wildcard origins = A [OK]

Hint: Use setAllowedOriginPatterns for wildcard origins [OK]

Common Mistakes:

• Using setAllowedOrigins with "*" string
• Allowing extra HTTP methods by mistake
• Passing string instead of list to allowed origins