title: Spring @CrossOrigin not working
body: <p>I'm using spring-web for building a json/rest backend for my web/mobile application. 
  I was using javax.servlet.Filter, adding appropriate cors header:</p>
  
  <pre><code>public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
          HttpServletResponse response = (HttpServletResponse) res;
          response.setHeader("Access-Control-Allow-Origin", "*");
          response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
          response.setHeader("Access-Control-Max-Age", "3600");
          response.setHeader("Access-Control-Allow-Headers", "x-requested-with, accept, authorization, content-type");
          response.setHeader("X-Frame-Options", "SAMEORIGIN");
          chain.doFilter(req, res);
      }
  </code></pre>
  
  <p>Now i'm trying to upgrade to spring 4.2.5 and use @CrossOrigin annotation, but it seems that OPTION dispatched response doesn't contains appropriate headers. </p>
  
  <p>Here my configuration:</p>
  
  <pre><code>@Configuration
  @EnableWebMvc
  @ComponentScan(basePackages = "it.foo.api.rest", useDefaultFilters = false, 
      includeFilters = @ComponentScan.Filter(value = Controller.class, type = FilterType.ANNOTATION))
  public class WebConfig extends WebMvcConfigurerAdapter {
  
      ...
  
      @Override
      public void addCorsMappings(CorsRegistry registry) {
          registry.addMapping("/**");
  //          .allowCredentials(true)
  //          .allowedOrigins("*")
  //          .maxAge(3600)
  //          .allowedMethods("PUT", "POST", "GET", "OPTIONS", "DELETE")
  //          .allowedHeaders("content-type", "authorization", "x-requested-with", "accept", "origin", "Access-Control-Request-Method", "Access-Control-Request-Headers")
  //          .exposedHeaders("Access-Control-Allow-Origin", "Access-Control-Allow-Credentials");
  //          .exposedHeaders("x-requested-with, accept, authorization, content-type");
      }
  </code></pre>
  
  <p>as you can see i've tryed some configurations.</p>
  
  <p>My controller:</p>
  
  <pre><code>@CrossOrigin(allowCredentials="true", 
      methods={RequestMethod.GET,RequestMethod.POST,RequestMethod.PUT,RequestMethod.OPTIONS,RequestMethod.DELETE},
      allowedHeaders={"x-requested-with", "accept", "authorization", "content-type"}, 
      exposedHeaders={"access-control-allow-headers", "access-control-allow-methods", "access-control-allow-origin", "access-control-max-age", "X-Frame-Options"})
  @RestController
  @RequestMapping(value="/admin")
  public class AdminUserController extends BaseController {
  
  
      @RequestMapping(value = "/login", method = RequestMethod.POST,  produces = MediaType.APPLICATION_JSON_VALUE)
      public HttpEntity&lt;AdminUserResource&gt; postLogin(@RequestBody AdminLoginCredentials credentials) {
          return new ResponseEntity&lt;AdminUserResource&gt;(..., HttpStatus.OK);
      }
  </code></pre>
  
  <p>Again i've tested with several configuration, with only basic @CrossOrigin annotation.</p>
  
  <p>Headers WITH servlet filter (old version): <a href="https://i.stack.imgur.com/3Y4aT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/3Y4aT.png" alt="enter image description here"></a></p>
  
  <p>Headers WITHOUT filter and WITH @CrossOrigin (new version, not working):  <a href="https://i.stack.imgur.com/XZnkq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XZnkq.png" alt="enter image description here"></a></p>
  
  <p>i can't find out what i'm missing!</p>