Enable CORS in Spring 5 Webflux?

I had success with this custom filter:

import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.http.HttpHeaders;import org.springframework.http.HttpMethod;import org.springframework.http.HttpStatus;import org.springframework.http.server.reactive.ServerHttpRequest;import org.springframework.http.server.reactive.ServerHttpResponse;import org.springframework.web.cors.reactive.CorsUtils;import org.springframework.web.server.ServerWebExchange;import org.springframework.web.server.WebFilter;import org.springframework.web.server.WebFilterChain;import reactor.core.publisher.Mono;@Configurationpublic class CorsConfiguration {  private static final String ALLOWED_HEADERS = "x-requested-with, authorization, Content-Type, Authorization, credential, X-XSRF-TOKEN";  private static final String ALLOWED_METHODS = "GET, PUT, POST, DELETE, OPTIONS";  private static final String ALLOWED_ORIGIN = "*";  private static final String MAX_AGE = "3600";  @Bean  public WebFilter corsFilter() {    return (ServerWebExchange ctx, WebFilterChain chain) -> {      ServerHttpRequest request = ctx.getRequest();      if (CorsUtils.isCorsRequest(request)) {        ServerHttpResponse response = ctx.getResponse();        HttpHeaders headers = response.getHeaders();        headers.add("Access-Control-Allow-Origin", ALLOWED_ORIGIN);        headers.add("Access-Control-Allow-Methods", ALLOWED_METHODS);        headers.add("Access-Control-Max-Age", MAX_AGE);        headers.add("Access-Control-Allow-Headers",ALLOWED_HEADERS);        if (request.getMethod() == HttpMethod.OPTIONS) {          response.setStatusCode(HttpStatus.OK);          return Mono.empty();        }      }      return chain.filter(ctx);    };  }}

and org.springframework.boot:spring-boot-starter-web should not be included as dependency - filter does not work with it.

Here is another solution with the Webflux Configurer.

Side Note: Its Kotlin Code (copied from my project) but you can easily translate that to Java Code.

@Configuration@EnableWebFluxclass WebConfig: WebFluxConfigurer{    override fun addCorsMappings(registry: CorsRegistry)    {        registry.addMapping("/**")            .allowedOrigins("*") // any host or put domain(s) here            .allowedMethods("GET, POST") // put the http verbs you want allow            .allowedHeaders("Authorization") // put the http headers you want allow    }}

@Configurationpublic class WebFluxConfig {    @Bean    public WebFluxConfigurer corsConfigurer() {        return new WebFluxConfigurerComposite() {            @Override            public void addCorsMappings(CorsRegistry registry) {                registry.addMapping("/**").allowedOrigins("*")                        .allowedMethods("*");            }        };    }}

which corresponds to:

@Beanpublic WebMvcConfigurer corsConfigurer() {    return new WebMvcConfigurerAdapter() {        @Override        public void addCorsMappings(CorsRegistry registry) {

for spring mvc.