CORS error for 192.168.0.3/v1 but not for 192.168.0.3/v1/signup

Question

I am using Spring-boot config for basic-auth and when I am trying to access the http://192.168.0.3/v1 using credentials, I am getting CORS error, even though I have configurations for CORS. The weird thing is, when I am accessing the http://192.168.0.3/v1/signup, I am able to create a user. why CORS error for the root url access only?

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
@ComponentScan(basePackages = { "com.ofloy.rest.security" })
@Import({CorsConfig.class})
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManager();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .authorizeRequests()
        .antMatchers("/signup/**").permitAll()
        .anyRequest().authenticated()
        .and().httpBasic()
        .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and().csrf().disable()
        ;
    }
}

@Configuration
public class CorsConfig {

    @Bean
    public FilterRegistrationBean<Filter> customCorsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowCredentials(true);
        config.addAllowedOrigin("*");
        config.addAllowedHeader("*");
        config.addAllowedMethod("*");

        source.registerCorsConfiguration("/**", config);
        FilterRegistrationBean<Filter> bean = new FilterRegistrationBean<Filter>(new CorsFilter(source));
        bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
        return bean;
    }
}

I am using UserDetailsService for querying the real user from my DB and set server.servlet.context-path = /v1/

Basically two issues I am facing with the above configuration:

1. I am able to access http://192.168.0.3/v1/signup but not http://192.168.0.3/v1/ from the broweser, as getting CORS error.
2. Accessing http://192.168.0.3/v1(from POSTMAN) using the credentials to check if the credentials are correct, give me the 404 error. 404 if credentials are correct and 401 is not correct. Why 404?

Note: One thing I have noticed for second issues is, even if I send the POST request to http://192.168.0.3/v1, the spring Logs shows it GET request, here is the log stack.

DEBUG DispatcherServlet : GET "/v1/", parameters={}
WARN PageNotFound : No mapping for GET /v1/
DEBUG DispatcherServlet : Completed 404 NOT_FOUND DEBUG DispatcherServlet : "ERROR" dispatch for GET "/v1/error", parameters={}
DEBUG RequestMappingHandlerMapping : Mapped to public org.springframework.http.ResponseEntity org.springframework.boot.autoconfigure.web.servlet.error.BasicErrorController.error(javax.servlet.http.HttpServletRequest) DEBUG HttpEntityMethodProcessor : Using 'application/json', given
[/] and supported [application/json, application/*+json]
DEBUG HttpEntityMethodProcessor : Writing [{timestamp=Wed Jan 30 16:16:40 IST 2019, status=404, error=Not Found, message=No message available, path=/v1/}]
DEBUG DispatcherServlet : Exiting from "ERROR" dispatch, status 404

UPDATE: this is the CORS error in browser

Access to XMLHttpRequest at 'http://192.168.43.70:8085/v1' from origin 'http://localhost:3007' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

Answer 1

I would do something like below on the controller which handles the request:

@CrossOrigin(origins = "http://localhost:3007")
@RestController
@RequestMapping("/v1")
public class VoneController {