title: jBoss CORS support with security constraints
body: <p>I'm adding authentication to my API using the web-common security constraints, but it seems to have broken my CORS filter. I've previously had it working with just the filter and no app server level authentication.</p>
  
  <p>The basic idea is to require authentication on all requests expect those under the /rest/account endpoint, as these are the ones that handle the initial login and so need to be publicly accessible.</p>
  
  <p>Testing in both Chrome and Postman returns a 405 Method not allowed response when the OPTIONS call is made as part of the POST request when trying to login.</p>
  
  <p>Hopefully I've provided everything relevant below but let me know if anything else is needed. Thanks in advance!</p>
  
  <p>My CORS filter</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;CORS&lt;/filter-name&gt;
      &lt;filter-class&gt;com.thetransactioncompany.cors.CORSFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.supportedMethods&lt;/param-name&gt;
          &lt;param-value&gt;*&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.supportedHeaders&lt;/param-name&gt;
          &lt;param-value&gt;*&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.allowOrigin&lt;/param-name&gt;
          &lt;param-value&gt;*&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.allowSubdomains&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.supportsCredentials&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;CORS&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>My security constraints</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;display-name&gt;WebsiteUsers&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;WebsiteAPI&lt;/web-resource-name&gt;
          &lt;description/&gt;
          &lt;url-pattern&gt;/rest/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;description&gt;Standard User authentication&lt;/description&gt;
          &lt;role-name&gt;Users&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Public&lt;/web-resource-name&gt;
          &lt;description&gt;Matches a few special endpoints&lt;/description&gt;
          &lt;url-pattern&gt;/rest/account/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;!-- No auth-constraint means everybody has access! --&gt;
  &lt;/security-constraint&gt;
  </code></pre>