title: OPTIONS request forbidden in Spring Boot
body: <p>I read a lot of threads and solutions about this issue (including <a href="https://stackoverflow.com/a/33331945/4292792">this SO solution</a>), but I still have the 403 error when sending preflight requests.</p>
  
  <p>I'm using Spring Data Rest and I can work well with my repositories as long as there is no OPTIONS sent. I do not use Spring Security yet but I plan to configure it soon. Here is my current configuration:</p>
  
  <pre><code>@Configuration
  public class GlobalRepositoryRestConfigurer extends RepositoryRestConfigurerAdapter {
  
      @Override
      public void configureRepositoryRestConfiguration(RepositoryRestConfiguration config) {
          config.getCorsRegistry().addMapping("/**").allowedOrigins("*").allowedHeaders(
                  "*").exposedHeaders("Location").allowedMethods("GET", "PUT", "POST", "DELETE",
                                                                 "OPTIONS");
      }
  
      @Bean(name = DispatcherServletAutoConfiguration.DEFAULT_DISPATCHER_SERVLET_BEAN_NAME)
      public DispatcherServlet dispatcherServlet() {
          DispatcherServlet dispatcher = new DispatcherServlet();
          dispatcher.setDispatchOptionsRequest(true);
          return dispatcher;
      }
  }
  </code></pre>
  
  <p>I also tried the <code>application.properties</code> option, and setting my <code>allowedMethods</code> to <code>"*"</code> , but I end up with the 403 no matter what. Below are the request/response headers I got from the OPTIONS request.</p>
  
  <p><strong>Request headers</strong></p>
  
  <pre><code>Accept           text/html,application/xhtml+xm…plication/xml;q=0.9,*/*;q=0.8
  Accept-Encoding  gzip, deflate
  Accept-Language  fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
  Access-Control-Request-Headers   content-type
  Access-Control-Request-Method    POST
  Connection       keep-alive
  Host             localhost:8080
  Origin           http://localhost:4000
  Referer          http://localhost:4000/
  User-Agent       Mozilla/5.0 (Windows NT 10.0; …) Gecko/20100101 Firefox/64.0
  </code></pre>
  
  <p><strong>Response headers</strong></p>
  
  <pre><code>Allow            GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
  Content-Length   20
  Date             Sun, 30 Dec 2018 08:49:00 GMT
  </code></pre>
  
  <p>Do you see anything wrong or something else I could try?</p>