Allow CORS with Spring Security 6.1.1 with authenticated requests

I've upgraded from Spring Boot 2.5 to 3.1, which comes with Spring Security 6.1.1. Calls to the login authentication REST service work just fine, but all requests to other REST controllers that require authentication token are being blocked by the CORS policy.

I have followed the directions in Springs documentation to disable CORS, but it does not work.
https://docs.spring.io/spring-security/reference/reactive/integrations/cors.html#page-title

Here is the current configuration that I have:

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.addAllowedOriginPattern("*");
        configuration.setAllowedMethods(Arrays.asList("GET","POST","PUT","PATCH","DELETE","OPTIONS"));
        configuration.setAllowCredentials(false);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
                //.cors(cors -> cors.disable()) <<--- does not work as documented
            .csrf(AbstractHttpConfigurer::disable)
            .authorizeHttpRequests(request -> request
                    .requestMatchers("/api/auth/**").permitAll()
                    .requestMatchers(SYS_ADMIN_PATTERNS).hasAuthority("SYSTEM_ADMIN")
                    .requestMatchers("/api/v1/**").authenticated()
            )
            .sessionManagement(manager -> manager.sessionCreationPolicy(STATELESS))
            .authenticationProvider(authenticationProvider())
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

I have tried setting disabling the CORS using the .cors(cors -> cors.disable()), which did not disable CORS filtering.

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .cors(cors -> cors.disable()) 
            .csrf(AbstractHttpConfigurer::disable)
            .authorizeHttpRequests(request -> request
                    .requestMatchers("/api/auth/**").permitAll()
                    .requestMatchers(SYS_ADMIN_PATTERNS).hasAuthority("SYSTEM_ADMIN")
                    .requestMatchers("/api/v1/**").authenticated()
            )
            .sessionManagement(manager -> manager.sessionCreationPolicy(STATELESS))
            .authenticationProvider(authenticationProvider())
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

Also tried adding @CrossOrigin annotation tags to the REST controller classes, which did nothing. Also verified that I have the @Configuration annotation with the @EnableWebSecurity annotation (another change in Spring Security).

What am I missing?

The only way I could get it to work is to disable CORS in the SecurityFilterChain and annotate the RestController with @CrossOrigin. If you have the CorsConfigurationSource configured the @CrossOrigin annotations are ignored (or at least have no effect) and it simply doesn't work with Spring Security 6.1.

Here is the working configuration:

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .cors(AbstractHttpConfigurer::disable)
            .csrf(AbstractHttpConfigurer::disable)
            .authorizeHttpRequests(request -> request
                    .requestMatchers("/api/auth").permitAll()
                    .requestMatchers(HttpMethod.OPTIONS).permitAll()
                    .requestMatchers(SYS_ADMIN_PATTERNS).hasAuthority("SYSTEM_ADMIN")
                    .requestMatchers("/api/v1/**").authenticated()
            )
            .sessionManagement(manager -> manager.sessionCreationPolicy(STATELESS))
            .authenticationProvider(authenticationProvider())
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
        ;
        SecurityFilterChain chain = http.build();
        log.info("Configured security filter chain: {}",chain);
        return chain;
    }

Then ensure you have the @CrossOrigin annotations on your REST controllers at the class level or individual method level.

@RestController
@RequestMapping("/api/auth")
@RequiredArgsConstructor
@CrossOrigin
public class AuthenticationController {
...
}

After struggling for couple of days, I come to some conclusion, like how this is working.

I was facing a 401 error in my preflight request

I followed the documentation code since the preflight request was causing the problem, I added one more requestMather which is specifically for the preflight request

 .requestMatchers(HttpMethod.OPTIONS,"/**").permitAll()

and add @CrossOrigin to your controllers at class level