CORS Configuration in Spring MVC
Fast recall
Quick revision
Core answer
Practical understanding of CORS mechanics and the Spring configuration model for it.
Adding CORS headers manually in a Filter and also configuring it via Spring, causing duplicate headers that browsers reject; or not understanding that preflight OPTIONS requests bypass authentication.
Explain the distinction between simple and preflight requests, why @CrossOrigin on a method only applies to that method and not all methods in the class (unless placed on the class), and how Spring Security's cors() DSL should replace a raw CorsFilter when security is in the stack.
Interview-ready guide
Interview answer
CORS is a browser security mechanism that restricts JavaScript from reading responses from a different origin. Understanding CORS means understanding that the browser is the enforcer — the server only sends headers.
How a cross-origin request works
- Simple requests (GET, POST with
Content-Type: application/x-www-form-urlencoded): browser sends the request, then checks if theAccess-Control-Allow-Originheader permits the origin - Preflight: browser sends
OPTIONSfirst; server must respond with permitted methods, headers, and origins; then the actual request is sent
Configuration in Spring MVC
@CrossOrigin(origins = "https://app.example.com")on a controller or method — fine-grained, easy to understandWebMvcConfigurer.addCorsMappings()— global configuration for all or specific path patterns- Both can coexist — they are merged, not overridden
Spring Security interaction
- Spring Security's filter chain processes requests before
DispatcherServlet; if Security rejects the preflight OPTIONS request, it never reaches the MVC CORS configuration - Configure CORS via
http.cors(cors -> cors.configurationSource(corsConfigSource))so it applies at the filter chain level
The wildcard + credentials trap
allowedOrigins("*")withallowCredentials(true)is rejected by the browser spec- Use
allowedOriginPatterns("https://*.example.com")to allow subdomains with credentials
CORS Configuration in Spring MVC
Direct Answer
Spring MVC supports CORS at three levels of granularity: per-method with @CrossOrigin, globally via WebMvcConfigurer.addCorsMappings, and as a CorsFilter bean for full control. Spring handles the preflight OPTIONS request automatically when CORS is configured, returning the correct Access-Control-* headers without you writing any low-level header code.
Common Mistakes & Pitfalls
Adding CORS headers manually in a Filter and also configuring it via Spring, causing duplicate headers that browsers reject; or not understanding that preflight OPTIONS requests bypass authentication.
Check your understanding
Answer these without looking back at the article.
- Why does CORS need to be configured in Spring Security and not just in Spring MVC when both are present?
- What is the difference between allowedOrigins and allowedOriginPatterns?
- How do you enable CORS for a Spring WebFlux application — is the approach the same?
Related interview prep categories
1Want a guided curriculum order?
These modules are also sequenced in our flagship backend interview track — open it when you prefer an ordered path instead of browsing by topic.