👀 Views: 12 💬 Answers: 1 📅 Created: 2025-06-22

spring-boot cors rest Java

I'm stuck on something that should probably be simple. I'm currently developing a Spring Boot REST API that requires custom headers for authentication, and I'm running into issues with CORS preflight requests... My server is configured to allow requests from a specific frontend application, but when I include custom headers like `X-Custom-Auth`, the preflight OPTIONS request fails. I have the following configuration in my `WebMvcConfigurer` implementation: ```java import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.web.servlet.config.annotation.CorsRegistry; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; @Configuration public class WebConfig implements WebMvcConfigurer { @Override public void addCorsMappings(CorsRegistry registry) { registry.addMapping("/api/**").allowedOrigins("http://localhost:3000") .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS") .allowedHeaders("X-Custom-Auth", "Content-Type") .allowCredentials(true); } } ``` However, in the browser console, I see the following behavior message: `CORS policy: Request header 'X-Custom-Auth' is not allowed`. I've tried adding `allowedHeaders()` to specify the custom header, but it seems to have no effect. I've also attempted to set up a global CORS configuration using `CorsConfigurationSource`, but still working with the same scenario: ```java import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.cors.UrlBasedCorsConfigurationSource; import org.springframework.web.cors.CorsConfigurationSource; import org.springframework.web.filter.CorsFilter; @Configuration public class GlobalCorsConfig { @Bean public CorsFilter corsFilter() { UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); CorsConfiguration config = new CorsConfiguration(); config.setAllowCredentials(true); config.addAllowedOrigin("http://localhost:3000"); config.addAllowedHeader("X-Custom-Auth"); config.addAllowedHeader("Content-Type"); config.addAllowedMethod("GET"); config.addAllowedMethod("POST"); source.registerCorsConfiguration("/api/**", config); return new CorsFilter(source); } } ``` I'm using Spring Boot 2.6.4, and no matter what combination of headers or methods I try to allow, the CORS request fails. How can I correctly set up CORS to work with custom headers in a Spring Boot REST API? Any insights or solutions would be greatly appreciated! I'm coming from a different tech stack and learning Java. Could this be a known issue? This is happening in both development and production on macOS. I appreciate any insights! I'd love to hear your thoughts on this.