Spring @CrossOrigin not working
<p>I'm using spring-web for building a json/rest backend for my web/mobile application. 
I was using javax.servlet.Filter, adding appropriate cors header:</p>

<pre><code>public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "x-requested-with, accept, authorization, content-type");
        response.setHeader("X-Frame-Options", "SAMEORIGIN");
        chain.doFilter(req, res);
    }
</code></pre>

<p>Now i'm trying to upgrade to spring 4.2.5 and use @CrossOrigin annotation, but it seems that OPTION dispatched response doesn't contains appropriate headers. </p>

<p>Here my configuration:</p>

<pre><code>@Configuration
@EnableWebMvc
@ComponentScan(basePackages = "it.foo.api.rest", useDefaultFilters = false, 
    includeFilters = @ComponentScan.Filter(value = Controller.class, type = FilterType.ANNOTATION))
public class WebConfig extends WebMvcConfigurerAdapter {

    ...

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**");
//          .allowCredentials(true)
//          .allowedOrigins("*")
//          .maxAge(3600)
//          .allowedMethods("PUT", "POST", "GET", "OPTIONS", "DELETE")
//          .allowedHeaders("content-type", "authorization", "x-requested-with", "accept", "origin", "Access-Control-Request-Method", "Access-Control-Request-Headers")
//          .exposedHeaders("Access-Control-Allow-Origin", "Access-Control-Allow-Credentials");
//          .exposedHeaders("x-requested-with, accept, authorization, content-type");
    }
</code></pre>

<p>as you can see i've tryed some configurations.</p>

<p>My controller:</p>

<pre><code>@CrossOrigin(allowCredentials="true", 
    methods={RequestMethod.GET,RequestMethod.POST,RequestMethod.PUT,RequestMethod.OPTIONS,RequestMethod.DELETE},
    allowedHeaders={"x-requested-with", "accept", "authorization", "content-type"}, 
    exposedHeaders={"access-control-allow-headers", "access-control-allow-methods", "access-control-allow-origin", "access-control-max-age", "X-Frame-Options"})
@RestController
@RequestMapping(value="/admin")
public class AdminUserController extends BaseController {


    @RequestMapping(value = "/login", method = RequestMethod.POST,  produces = MediaType.APPLICATION_JSON_VALUE)
    public HttpEntity&lt;AdminUserResource&gt; postLogin(@RequestBody AdminLoginCredentials credentials) {
        return new ResponseEntity&lt;AdminUserResource&gt;(..., HttpStatus.OK);
    }
</code></pre>

<p>Again i've tested with several configuration, with only basic @CrossOrigin annotation.</p>

<p>Headers WITH servlet filter (old version): <a href="https://i.stack.imgur.com/3Y4aT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/3Y4aT.png" alt="enter image description here"></a></p>

<p>Headers WITHOUT filter and WITH @CrossOrigin (new version, not working):  <a href="https://i.stack.imgur.com/XZnkq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XZnkq.png" alt="enter image description here"></a></p>

<p>i can't find out what i'm missing!</p>