CORS configuration in Security in Spring Boot - Step-by-Step Execution

Concept Flow - CORS configuration in Security

Client sends HTTP request

↓

Server receives request

↓

Spring Security intercepts request

↓

Check CORS configuration

↓

Process request

↓

Send response back to client

This flow shows how a client request is checked against CORS rules in Spring Security before processing or rejecting it.

Execution Sample

Spring Boot

http.cors().and().authorizeRequests()
  .anyRequest().authenticated();

@Bean
CorsConfigurationSource corsConfigurationSource() {
  CorsConfiguration config = new CorsConfiguration();
  config.setAllowedOrigins(List.of("http://example.com"));
  config.setAllowedMethods(List.of("GET", "POST"));
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  source.registerCorsConfiguration("/**", config);
  return source;
}

This code configures Spring Security to allow CORS requests only from http://example.com with GET and POST methods.

Execution Table

Step	Request Origin	Request Method	CORS Allowed?	Action	Response
1	http://example.com	GET	Yes	Process request	200 OK with data
2	http://example.com	POST	Yes	Process request	200 OK with data
3	http://malicious.com	GET	No	Reject request	403 CORS error
4	http://example.com	DELETE	No	Reject request	403 CORS error
5	http://example.com	OPTIONS	Yes	Process preflight	200 OK preflight
6	http://unknown.com	POST	No	Reject request	403 CORS error
7	-	-	-	-	Stop: No more requests

💡 Requests stop being processed when origin or method is not allowed by CORS config.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
allowedOrigins	[]	[http://example.com]	[http://example.com]	[http://example.com]	[http://example.com]	[http://example.com]
allowedMethods	[]	[GET, POST]	[GET, POST]	[GET, POST]	[GET, POST]	[GET, POST]
requestOrigin	-	http://example.com	http://example.com	http://malicious.com	http://example.com	-
requestMethod	-	GET	POST	GET	DELETE	-
corsAllowed	-	true	true	false	false	-

Key Moments - 3 Insights

Why does a request from http://malicious.com get rejected even if the method is GET?

Because the origin http://malicious.com is not in the allowedOrigins list as shown in execution_table row 3, so CORS blocks it.

Why is the OPTIONS method allowed even though it is not explicitly listed in allowedMethods?

OPTIONS is used for CORS preflight requests and is automatically handled by Spring Security when CORS is enabled, as seen in execution_table row 5.

What happens if the request method is DELETE which is not allowed?

The request is rejected with a CORS error because DELETE is not in allowedMethods, shown in execution_table row 4.

Visual Quiz - 3 Questions

Look at the execution_table, what is the response when the request origin is http://example.com and method is GET?

A 404 Not Found

B 403 CORS error

C 200 OK with data

D 500 Server Error

💡 Hint

Check execution_table row 1 under Response column.

At which step does the CORS check fail due to an unallowed origin?

A Step 2

B Step 3

C Step 5

D Step 1

💡 Hint

Look at execution_table row 3 where requestOrigin is http://malicious.com and CORS Allowed? is No.

If we add "DELETE" to allowedMethods, which step's action would change from reject to process?

A Step 4

B Step 6

C Step 3

D Step 5

💡 Hint

Check execution_table row 4 where method is DELETE and action is reject.

Concept Snapshot

CORS configuration in Spring Security:
- Enable with http.cors() in SecurityFilterChain
- Define allowed origins and methods in CorsConfigurationSource bean
- Spring Security checks origin and method on each request
- Allowed requests proceed, others get CORS error
- OPTIONS requests for preflight handled automatically

Full Transcript

When a client sends a request, Spring Security intercepts it and checks the CORS configuration. It compares the request's origin and method with the allowed origins and methods defined in the CorsConfigurationSource bean. If both match, the request is processed normally and a successful response is sent. If either the origin or method is not allowed, Spring Security rejects the request with a CORS error, preventing unauthorized cross-origin access. OPTIONS requests are treated as preflight checks and allowed automatically if CORS is enabled. This ensures only trusted origins and methods can access the server resources.