title: Access blocked by CORS policy: Response to preflight request doesn't pass access control check
body: <p>I'm trying to create a user administration API for my web app. When I send an API call from my frontend to my backend, a cors error occurs. How can the cors problem be solved? I've read a lot of threads, but I haven't made any progress.</p>
  
  <p><strong>Error after createUser() API call</strong></p>
  
  <pre><code>Access to XMLHttpRequest at 'http://localhost:8080/user/create' 
  from origin 'http://localhost:4200' has been blocked by CORS policy: 
  Response to preflight request doesn't pass access control check: 
  Redirect is not allowed for a preflight request.
  </code></pre>
  
  <p><strong>Angular header.config.ts</strong></p>
  
  <pre><code>export const HTTP_OPTIONS = {
    headers: new HttpHeaders({
      'Content-Type':  'application/json',
      'Access-Control-Allow-Credentials' : 'true',
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'GET, POST, PATCH, DELETE, PUT, OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With',
    })
  };
  </code></pre>
  
  <p><strong>Angular rest-user.service.ts</strong></p>
  
  <pre><code>  public createUser() {
      return this.httpClient.post(this.USER_ENDPOINT + 'create', HTTP_OPTIONS);
    }
  </code></pre>
  
  <p><strong>SpringConfig.class</strong></p>
  
  <pre><code>@Configuration
  @EnableWebMvc
  public class SpringConfig implements WebMvcConfigurer {
  
      @Override
      public void addCorsMappings(CorsRegistry registry) {
          registry.addMapping("/**");
      }
  }
  </code></pre>
  
  <p><strong>SpringSecurityConfig.class</strong></p>
  
  <pre><code>@Configuration
  public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {  
      @Override  
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().anyRequest().authenticated()
          .and().oauth2Client()
          .and().oauth2Login();
      }
  
  }
  </code></pre>
  
  <p><strong>UserRestController.class</strong></p>
  
  <pre><code>@PostMapping("/user/create")
  @ResponseBody
  @ResponseStatus(HttpStatus.CREATED)
  public void createUser(Principal principal) throws UserAlreadyExistsException {
      userServiceFacadeImpl.createUser(principal.getName());
  }
  </code></pre>
  
  <p><strong>Network Message</strong></p>
  
  <p><a href="https://i.stack.imgur.com/h4g0F.png" rel="noreferrer"><img src="https://i.stack.imgur.com/h4g0F.png" alt="enter image description here"></a></p>
  
  <p><strong>UPDATE 20.06.19</strong></p>
  
  <pre><code>  private createUser() {
  
      const headersObject = new HttpHeaders();
  
      this.oktaAuth.getAccessToken().then( (value) =&gt; {
  
        headersObject.append('Authorization', 'Bearer ' + value);
        headersObject.append('Content-Type', 'application/json');
  
        const httpOptions = {
          headers: headersObject
        };
  
        this.httpClient.post('http://localhost:8080/user/' + 'create', null, httpOptions);
      });
  
    }
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/NVWh2.png" rel="noreferrer"><img src="https://i.stack.imgur.com/NVWh2.png" alt="enter image description here"></a></p>