title: Spring Security CORS issue when passing Authorization header
body: <p>I had wasted lot's of time fixing this issue, but none of the existing solutions work in my case.
  Let me explain you the server set up I have.
  I have 2 docker containers, one for angular app (nginx - url - <a href="http://localhost:8080" rel="nofollow noreferrer">http://localhost:8080</a>) and spring boot application (tomcat - url - <a href="http://localhost:8081" rel="nofollow noreferrer">http://localhost:8081</a>).
  This app is using Oauth2 jdbcToken authentication for API request.</p>
  
  <p>This app is a simple user registration app.</p>
  
  <p>I could register a new user since the register url is not secured and not passing any Authorization header.
  But once when user logs in the CORS issue kick in. below I have listed the errors.</p>
  
  <blockquote>
    <p>Access to XMLHttpRequest at '<a href="http://localhost:8081/v1/api/group/find/shib" rel="nofollow noreferrer">http://localhost:8081/v1/api/group/find/shib</a>' from origin '<a href="http://localhost:8080" rel="nofollow noreferrer">http://localhost:8080</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.</p>
  </blockquote>
  
  <p>Let me tell you what I had done to resolve this.
  In angular HTTP request I have added the following headers.</p>
  
  <pre><code>'Authorization' : 'Bearer '+this.token(),
  'Access-Control-Allow-Methods' : '*',
  'Access-Control-Allow-Origin' : "*",
  'Access-Control-Allow-Headers' : 'Content-Type, Accept, X-Requested-With, remember-me, Authorization',
  "Access-Control-Expose-Headers" : "Content-Type, Accept, X-Requested-With, remember-me, Authorization"
  </code></pre>
  
  <p>In spring boot I added @CrossOrigin / @CrossOrigin("http:localhost:8080") on Rest controllers added with a CORSFilter</p>
  
  <pre><code>@Override
  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
  
  
      HttpServletRequest request = (HttpServletRequest) req;
      HttpServletResponse response = (HttpServletResponse) res;
  
      response.setHeader("Access-Control-Allow-Origin", "*");
      response.setHeader("Access-Control-Allow-Credentials", "true");
      response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
      response.setHeader("Access-Control-Max-Age", "3600");
      response.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me, Authorization");
      chain.doFilter(req, res);
  }
  </code></pre>
  
  <p>After all the trial and error, I am still getting the same error</p>