Angular 1.4，POST，Spring Security，CORS

Question

In my former post, i was trying to send a JSON with a list from angular to spring mvc with POST method. And now it works fine !!! controller :

@RequestMapping(value="/create/", method=RequestMethod.POST)
@ResponseBody
public StatusResponse create(@RequestBody EventsDTO events) throws TechnicalException {
return new StatusResponse();
}

Angular :

 var _queryPost = function(url, data, defData) {

        $http({
          headers: {'Content-Type': 'application/json',
                    'Accept': 'application/json'},
          method: 'POST',
          url: url,
          //params: data,
          data: data,
            withCredentials: true
        })
          .success(function (data, status, headers, config) {
            defData.$resolve(data);
            $log.info(data);
          })
          .error(function (data, status, headers, config) {
            defData.$reject(data);
          });

        return defData;
    };

But to succeed i had to comment Spring security... When i use spring security, i got Error 401 with POST request that becomes OPTIONS request. After reading a lot of docs and posts, i understood that : 1- a first OPTIONS request is done before sending the POST request (it's a check) 2- The error happens because 'Content-type' value is "application/json". The allowed Content-Type values are "application/x-www-form-urlencoded" and others that i have forgotten but not "application/json"

The problem is that if i change the value of my Content-type in Angular i got error 415....

I have tryed differents things i have found, like some adds in angular :

$httpProvider.defaults.headers.common['X-XSRF-Token'] = $('meta[name=csrf-token]').attr('content')
$httpProvider.defaults.withCredentials = true;
$httpProvider.defaults.headers.common={'Accept' : 'application/json'};
$httpProvider.defaults.headers.post={'Content-Type' : 'application/json'};
$httpProvider.defaults.useXDomain = true;
delete $httpProvider.defaults.headers.common['X-Requested-With'];

But i think it doesn't work with angular version > 1.2 (i use 1.4) This is my Spring security config in web.xml :

<!-- CORS related filter -->
<filter>
    <filter-name>CORS</filter-name>
    <filter-class>
      org.eclipse.jetty.servlets.CrossOriginFilter
    </filter-class>

    <init-param>
        <param-name>allowedOrigins</param-name>
        <param-value>*</param-value>
    </init-param>
   <init-param>
        <param-name>allowedMethods</param-name>
        <param-value>GET,POST,DELETE,PUT,HEAD,OPTIONS</param-value>
    </init-param>
    <init-param>
        <param-name>allowedHeaders</param-name>
        <param-value>
           origin, content-type, accept, authorization, 
              x-requested-with, access-token, x-xsrf-token
        </param-value>
    </init-param>
    <init-param>
        <param-name>supportsCredentials</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>

<filter-mapping>
    <filter-name>CORS</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>


<!-- Spring Security Filters -->
<filter>
   <filter-name>springSecurityFilterChain</filter-name>
   <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

So what can i do to pass my EventsDTO bean with spring security ? Must i change Angular config or spring security config ? and HOW ?

Answer 1

If you don't need to do anything specific for CORS OPTION prefligh request (I believe you don't), then just configure CrossOriginFilter to answer w/o passing it to main app. As I understand it can be done through:

<init-param>
    <param-name>chainPreflight</param-name>
    <param-value>false</param-value>
</init-param>

or, if it doesn't work, make an empty Spring controller for OPTION requests.

PS app shouldn't make any meaningful response for such OPTION request, it's a CORS preflight , so just respond with Access-Control-XXX headers. That's what CrossOriginFilter will do.