CORS configuration in Security in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable CORS in a Spring Security configuration.

Spring Boot

http.cors([1]());

Drag options to blanks, or click blank then click option'

AwithDefaults()

Band

Cdisable

Dconfigure

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'disable' disables CORS.

Using 'and' or 'configure' are not valid here.

The cors(withDefaults()) method enables CORS support in Spring Security. Calling withDefaults() activates it with default settings.

2fill in blank

medium

Complete the code to define a CORS configuration source bean.

Spring Boot

@Bean
public CorsConfigurationSource [1]() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.addAllowedOrigin("*");
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

Drag options to blanks, or click blank then click option'

AcorsSource

BcorsSetup

CcorsConfig

DcorsConfigurationSource

Attempts:

3 left

💡 Hint

Common Mistakes

Using a method name that Spring Security does not recognize will cause CORS to not be applied.

Using generic names like 'corsSetup' may not be detected automatically.

The method name corsConfigurationSource is the standard name Spring Security looks for to get CORS settings.

3fill in blank

hard

Fix the error in the CORS configuration to allow credentials.

Spring Boot

CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowCredentials([1]);

Drag options to blanks, or click blank then click option'

Afalse

Btrue

Cnull

D"true"

Attempts:

3 left

💡 Hint

Common Mistakes

Passing a string like "true" instead of the Boolean true causes errors.

Passing null disables the setting.

The setAllowCredentials method expects a Boolean true or false, not a string or null.

4fill in blank

hard

Fill both blanks to restrict allowed HTTP methods to GET and POST in CORS configuration.

Spring Boot

CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedMethods(List.of([1], [2]));

Drag options to blanks, or click blank then click option'

A"GET"

B"POST"

C"PUT"

D"DELETE"

Attempts:

3 left

💡 Hint

Common Mistakes

Including methods like PUT or DELETE when only GET and POST are desired.

Passing method names without quotes causes syntax errors.

To allow only GET and POST methods, pass their names as strings in the allowed methods list.

5fill in blank

hard

Fill all three blanks to create a complete Spring Security CORS configuration bean with allowed origins, methods, and credentials.

Spring Boot

CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(List.of([1]));
configuration.setAllowedMethods(List.of([2]));
configuration.setAllowCredentials([3]);

Drag options to blanks, or click blank then click option'

A"https://example.com"

B"GET"

Ctrue

D"*"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "*" for allowed origins disables credentials support.

Passing strings instead of Boolean for allowCredentials causes errors.

This sets allowed origins to a specific URL, allowed methods to GET, and enables credentials support.