title: Spring Boot + Security: No Access-Control-Allow-Origin header when setting allowed origins
body: <p>I'm using Spring Boot v2.1.1.RELEASE together with Spring Security and am trying to log into the application via REST.</p>
  
  <p>I have a configuration file which implements <code>WebMvcConfigurer</code> so I can override the addCorsMappings method:</p>
  
  <pre><code>@Override
  public void addCorsMappings(final CorsRegistry registry) {
      registry.addMapping("/**");
  }
  </code></pre>
  
  <p>This works fine; I can send my login data to <code>http://localhost:8080/login</code> and get a normal Response back, with session cookie and all:</p>
  
  <pre><code>Access-Control-Allow-Origin: *
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Content-Length: 0
  Date: Sun, 20 Jan 2019 13:14:46 GMT
  Expires: 0
  Pragma: no-cache
  Set-Cookie: JSESSIONID=66B74AE4F547BA77604AE199E0A48D7E; Path=/; HttpOnly
  Vary: Origin
  Vary: Access-Control-Request-Method
  Vary: Access-Control-Request-Headers
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  </code></pre>
  
  <p>Mind the <code>Access-Control-Allow-Origin</code> header.
  However, if I specify the allowed origins as follows, the Response does not include the formerly mentioned header:</p>
  
  <pre><code>@Override
  public void addCorsMappings(final CorsRegistry registry) {
      registry.addMapping("/**").allowedOrigins("localhost");
  }
  </code></pre>
  
  <p>Will result in the Response:</p>
  
  <pre><code>Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Content-Length: 20
  Date: Sun, 20 Jan 2019 13:15:15 GMT
  Expires: 0
  Pragma: no-cache
  Vary: Origin
  Vary: Access-Control-Request-Method
  Vary: Access-Control-Request-Headers
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  </code></pre>
  
  <p>It doesn't matter which origin I am allowing; "<a href="http://localhost" rel="nofollow noreferrer">http://localhost</a>", "<a href="http://example.com" rel="nofollow noreferrer">http://example.com</a>" and "example.com" all lead to the same result.</p>
  
  <p>While debugging, I noticed that the authentication process stops at the CorsFilter when I include the <code>allowedOrigins</code> bit in the code.</p>
  
  <p>This is all about the login process! I can't use the <code>@CrossOrigin</code> annotation (as far as I'm aware) because I have no method to put it on.</p>
  
  <p>I am testing the REST login with this script: <a href="https://pastebin.com/YezC3wWr" rel="nofollow noreferrer">https://pastebin.com/YezC3wWr</a></p>
  
  <p>Is this a bug in Spring or by design? Am I missing something here?</p>
  
  <p><strong>EDIT</strong>: The "Access-Control-Allow-Origin" header in the response is only sent if the request is sent from an allowed origin, and that was NOT the case. I was hosting the HTML test file on <code>http://localhost:8000</code>, so I had to add <strong>this exact URL</strong> to the allowed origins on the server. Not <code>localhost</code>, not <code>localhost:8000</code> but <code>http://localhost:8000</code>. The authentication then succeeds and the header is also included in the response.</p>