content: package com.anilallewar.microservices.gateway.security;
  
  import org.springframework.boot.actuate.autoconfigure.ManagementServerProperties;
  import org.springframework.boot.autoconfigure.security.oauth2.client.EnableOAuth2Sso;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.core.annotation.Order;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.config.http.SessionCreationPolicy;
  import org.springframework.web.cors.CorsConfiguration;
  import org.springframework.web.cors.CorsConfigurationSource;
  import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
  
  import com.google.common.collect.ImmutableList;
  
  @Configuration
  @EnableWebSecurity
  @Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER)
  @EnableOAuth2Sso
  public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
  
  	@Override
  	public void configure(HttpSecurity http) throws Exception {
  
  		// @formatter:off
  		http
  			// configure CORS -- uses a Bean by the name of corsConfigurationSource (see method below)
          		// CORS must be configured prior to Spring Security
  			.cors()
  			.and()
  				.sessionManagement()
  					.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  			.and()
  				.authorizeRequests()
  					.antMatchers("/**")
  						.permitAll()
  			.and()
  				.csrf()
  					.disable();
  		// @formatter:on
  	}
  
  	@Bean
  	public CorsConfigurationSource corsConfigurationSource() {
  		final CorsConfiguration configuration = new CorsConfiguration();
  		configuration.setAllowedOrigins(ImmutableList.of("*"));
  		configuration.setAllowedMethods(ImmutableList.of("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));
  
  		// setAllowCredentials(true) is important, otherwise:
  		// The value of the 'Access-Control-Allow-Origin' header in the response must
  		// not be the wildcard '*' when the request's credentials mode is 'include'.
  		configuration.setAllowCredentials(true);
  
  		// setAllowedHeaders is important! Without it, OPTIONS preflight request
  		// will fail with 403 Invalid CORS request
  		configuration.setAllowedHeaders(ImmutableList.of("*"));
  
  		final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  		source.registerCorsConfiguration("/**", configuration);
  		return source;
  	}
  }
  