title: blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header
body: <p>ive a spring boot app with angular front deployed in heroku. I configurated my spring backed to disable cors errors and ive had no problems until i implemented jwt authentication in my app. Then suddenly ive cors problems again. More specifically, appears this error:</p>
  <p><em>Access to XMLHttpRequest at 'https://serene-wave-12377.herokuapp.com/api/register' from origin 'http://localhost:49720' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.</em></p>
  <p>Ive tried everything ive seen, but i still get this error.</p>
  <p><strong>my webSecurityConfig:</strong></p>
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      private final userService userService;
  
      public WebSecurityConfig(userService userService) {
          this.userService = userService;
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.cors().and().csrf().disable()
                  .authorizeRequests() // authorize
                  .antMatchers(&quot;/**&quot;)
                  .permitAll()
                  .anyRequest().authenticated() // all requests are authenticated
                  .and()
                  .httpBasic();
  
      }
      @Bean
      public static PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
  
      @Bean
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Bean
      public CorsConfigurationSource corsConfigurationSource() {
          final CorsConfiguration configuration = new CorsConfiguration();
          configuration.addAllowedOrigin(&quot;*&quot;);
          configuration.addAllowedMethod(&quot;*&quot;);
          configuration.addAllowedHeader(&quot;*&quot;);
          configuration.setAllowCredentials(true);
  
          final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          source.registerCorsConfiguration(&quot;/**&quot;, configuration);
          return source;
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
      }
  }
  </code></pre>
  <p><strong>springBootApplication</strong></p>
  <pre><code>@SpringBootApplication
  public class HibernateProjectApplication extends SpringBootServletInitializer {
  
      public static void main(String[] args) {
  
          SpringApplication.run(HibernateProjectApplication.class, args);
      }
      @Bean
      public WebMvcConfigurer corsConfigurer() {
          return new WebMvcConfigurer() {
              @Override
              public void addCorsMappings(CorsRegistry registry) {
                  registry.addMapping(&quot;/**&quot;)
                          .allowedMethods(&quot;HEAD&quot;, &quot;GET&quot;, &quot;POST&quot;, &quot;PUT&quot;, &quot;DELETE&quot;, &quot;OPTIONS&quot;)
                          .allowedHeaders(&quot;*&quot;).allowedOrigins(&quot;*&quot;);
              }
          };
      
  </code></pre>
  <p>}</p>
  <p><strong>UserController:</strong></p>
  <pre><code>@CrossOrigin(origins = &quot;*&quot;, exposedHeaders=&quot;Access-Control-Allow-Origin&quot;)
  @RestController
  @RequestMapping(&quot;/api&quot;)
  public class UserController {  //methods
  </code></pre>
  <p><strong>Ive also tried in my front end angular app:</strong></p>
  <pre><code>  register(registerForm: any): Observable&lt;any&gt; {
      let body = {
        email: registerForm.email,
        password: registerForm.password,
        name: registerForm.name,
        surname: registerForm.surname,
      };
      const headers = new HttpHeaders()
        .set('content-type', 'application/json')
        .set('Access-Control-Allow-Origin', '*');
  
      return this.http.post(
        'https://serene-wave-12377.herokuapp.com/api/register',
        body
      ),  { 'headers': headers };
    }
  </code></pre>
  <p>Nothing works. I appreciate a lot any help/idea you guys may suggest. Thanks in advance!</p>