@CrossOrigin in Spring Boot — CORS Configuration for REST APIs

Direct Answer

CORS is a browser-enforced protocol that allows a server to grant selected cross-origin script requests that the same-origin policy would otherwise restrict. @CrossOrigin adds CORS policy metadata to a controller or method; Spring then writes the appropriate headers and handles preflight requests. CORS does not authenticate a caller and does not block non-browser clients.

Code Example

@RestController
@RequestMapping("/api/orders")
@CrossOrigin(origins = "http://localhost:3000") // Class-level: applies to all methods
public class OrderController {

    @GetMapping
    public List<Order> getAllOrders() {
        return List.of(
            new Order(1L, "Laptop", 899.99),
            new Order(2L, "Mouse", 29.99)
        );
    }

    @PostMapping
    @CrossOrigin(origins = {"http://localhost:3000", "https://prod.example.com"}) // Method-level override
    public Order createOrder(@RequestBody Order order) {
        // Spring adds Access-Control-Allow-Origin header to response
        return order;
    }
}

record Order(Long id, String item, Double price) {}

Common Mistakes & Pitfalls

• Wildcard in Production: Using @CrossOrigin(origins = "*") disables CORS protection entirely, allowing any website to call your API and potentially steal user data through their browser. Use specific domains instead.
• Forgetting Credentials: When your frontend sends cookies or Authorization headers, you must set @CrossOrigin(allowCredentials = "true") AND specify exact origins (not wildcard), otherwise the browser blocks the request.
• Annotating Every Method: Freshers annotate every @GetMapping individually instead of putting @CrossOrigin once at class level, creating duplication. Use class-level for shared origins and method-level only for exceptions.