Loading published curriculum…

16 · Spring Security in depth / LESSON 81 OF 102

CORS, preflight, and credentialed requests

CORS controls which origins browser scripts may read responses from; it is not authentication.

Before this lesson: CSRF protection for browser applications

Understand the topic

A preflight OPTIONS request may precede a cross-origin operation and does not carry the same authentication state as the final request. Integrate CORS with the security chain so approved preflights are handled correctly.

Use explicit allowed origins for credentialed browser requests. Avoid reflecting arbitrary Origin headers. A command-line client is not constrained by browser CORS, so every protected endpoint still needs authentication and authorization.

EXAMPLE · JAVA

CORS configuration fragment

var cors = new org.springframework.web.cors.CorsConfiguration();
cors.setAllowedOrigins(java.util.List.of("https://app.example.com"));
cors.setAllowedMethods(java.util.List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
cors.setAllowedHeaders(java.util.List.of("Content-Type", "X-CSRF-TOKEN"));
cors.setAllowCredentials(true);
var source = new org.springframework.web.cors.UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/api/**", cors);

What to expect

Expose source as the CorsConfigurationSource bean and enable http.cors. Replace the illustrative origin with the real frontend origin and align headers with the chosen client.

YOUR TURN

Put it into practice

  1. 01Send preflight and actual requests from allowed and disallowed origins.
  2. 02Repeat with curl to distinguish browser CORS enforcement from endpoint authorization.
  3. 03Verify: The browser allows only intended origins while non-browser clients still require valid credentials.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

CORS controls which origins browser scripts may read responses from; it is not authentication.

  1. 01A preflight OPTIONS request may precede a cross-origin operation and does not carry the same authentication state as the final request. Integrate CORS with the security chain so approved preflights are handled correctly.
  2. 02Use explicit allowed origins for credentialed browser requests. Avoid reflecting arbitrary Origin headers. A command-line client is not constrained by browser CORS, so every protected endpoint still needs authentication and authorization.
  3. 03Trace the example: Expose source as the CorsConfigurationSource bean and enable http.cors. Replace the illustrative origin with the real frontend origin and align headers with the chosen client.

A mistake worth avoiding

Preflight fails before a valid cross-origin browser request can run.

DEBUGGING ROOM

Something broke. Where do you look?

Preflight fails before a valid cross-origin browser request can run.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Does CORS block an attacker using a non-browser HTTP client?

Choose one answer

BUILD IT YOURSELF

Send preflight and actual requests from allowed and disallowed origins.

  1. 1.Send preflight and actual requests from allowed and disallowed origins.
  2. 2.Repeat with curl to distinguish browser CORS enforcement from endpoint authorization.
  3. 3.Reproduce this failure, then repair it: Preflight fails before a valid cross-origin browser request can run.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Does CORS block an attacker using a non-browser HTTP client?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

The browser allows only intended origins while non-browser clients still require valid credentials.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references