title: Spring Security CORS not working
body: <p>I have the following config, based on the example here <a href="https://docs.spring.io/spring-security/site/docs/current/reference/html/cors.html" rel="nofollow noreferrer">https://docs.spring.io/spring-security/site/docs/current/reference/html/cors.html</a></p>
  
  <pre><code>@Override
  public void configure(HttpSecurity http) throws Exception {
      http
              .authorizeRequests()
              .anyRequest().authenticated()
              .and()
              .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
              .csrf().disable()
              .cors();
  }
  
  @Bean
  CorsConfigurationSource corsConfigurationSource() {
      CorsConfiguration configuration = new CorsConfiguration();
      configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
      configuration.setAllowedMethods(Arrays.asList("GET","POST"));
      UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
      source.registerCorsConfiguration("/**", configuration);
      return source;
  }
  </code></pre>
  
  <p>But when I test this out I am still able to access it from my localhost no problem. It's like the cors isn't being activated at all.</p>
  
  <p>edit: I should add that I am using Spring OAuth2 and this config is located in my <code>ResourceServerConfigurerAdapter</code></p>