java 30 lines · 6 steps

Configuring CORS in Spring MVC

A Spring config class registers a WebMvcConfigurer that defines cross-origin rules for the API endpoints.

Explained by highlit
Spring Intermediate cors configuration dependency-injection web-security beans
1package com.example.api.config;
2 
3import org.springframework.beans.factory.annotation.Value;
4import org.springframework.context.annotation.Bean;
5import org.springframework.context.annotation.Configuration;
6import org.springframework.web.servlet.config.annotation.CorsRegistry;
7import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
8 
9@Configuration
10public class WebCorsConfig {
11 
12 @Value("${app.cors.allowed-origins}")
13 private String[] allowedOrigins;
14 
15 @Bean
16 public WebMvcConfigurer corsConfigurer() {
17 return new WebMvcConfigurer() {
18 @Override
19 public void addCorsMappings(CorsRegistry registry) {
20 registry.addMapping("/api/**")
21 .allowedOrigins(allowedOrigins)
22 .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
23 .allowedHeaders("Authorization", "Content-Type", "X-Requested-With")
24 .exposedHeaders("Location", "X-Total-Count")
25 .allowCredentials(true)
26 .maxAge(3600);
27 }
28 };
29 }
30}
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1CORS policy in Spring MVC is centralized in one WebMvcConfigurer bean rather than scattered across controllers.
  2. 2Externalizing allowed origins to properties lets the same build run safely across dev, staging, and production.
  3. 3allowCredentials(true) requires explicit origins — it can't be combined with a wildcard, which is why the list is injected.

Related explainers

typescript 
import { registerLocaleData } from '@angular/common';
import localeFr from '@angular/common/locales/fr';
import localeFrExtra from '@angular/common/locales/extra/fr';
import localeDe from '@angular/common/locales/de';

Locale-aware bootstrapping in Angular

i18n localization dependency-injection
Intermediate 8 steps
typescript 
import { Module } from '@nestjs/common';
import { ConfigModule } from '@nestjs/config';
import * as Joi from 'joi';
 

Validating env config at boot in NestJS

configuration schema-validation environment-variables
Intermediate 8 steps
java 
@Component
@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {
 

Transparent column encryption in Spring & JPA

encryption aes-gcm jpa-converter
Advanced 10 steps
typescript 
import { Inject, Injectable, Logger } from '@nestjs/common';
import { CACHE_MANAGER } from '@nestjs/cache-manager';
import { Cache } from 'cache-manager';
import { InjectRepository } from '@nestjs/typeorm';

A cache-aside country lookup in NestJS

cache-aside dependency-injection batch-lookup
Intermediate 8 steps
java 
package com.acme.billing.config;
 
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.ConfigurationProperties;

Feature-flagged beans with Spring @ConditionalOnProperty

feature-flags conditional-beans strategy-pattern
Intermediate 5 steps
typescript 
import { Injectable, effect, signal, computed } from '@angular/core';
 
interface Preferences {
  theme: 'light' | 'dark';

A signal-based preferences store in Angular

signals state-management persistence
Intermediate 7 steps

Share this explainer

Here's the card — post it anywhere.

Configuring CORS in Spring MVC — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code