title: Spring Boot CORS settings: CrossOrigin annotation works addCorsMappings doesn't
body: <p>I have a Spring Boot Rest application where I need to allow CORS requests.</p>
  
  <p>Requests use the common path <code>&lt;host&gt;:&lt;port&gt;/api/...</code> and so far I only have two resources:</p>
  
  <pre><code>package my.controllers;
  
  @RestController
  @RequestMapping(path="/", produces="application/json")
  public class DataController {
  
      @GetMapping("/")
      public ApiResponse&lt;Map&lt;String, Object&gt;&gt; getValues() {
          // ...
      }
  
      @GetMapping("/sub")
      public ApiResponse&lt;String&gt; getValuesSub() {
          // ...
      }
  </code></pre>
  
  <p>Here are two example requests from the Javascript client running at <code>http://localhost:3000/</code>:</p>
  
  <pre><code>fetch('http://localhost:2001/api/').then(/* ... */);
  fetch('http://localhost:2001/api/sub')).then(/* ... */);
  </code></pre>
  
  <p>If I add the <code>@CrossOrigin(origins = "*")</code> annotation to the controller, CORS requests work fine; if I replace it implementing <code>WebMvcConfigurer.addCorsMappings()</code> though:</p>
  
  <pre><code>@ComponentScan(basePackages={ "my.controllers" })
  @Configuration
  public class WebappConfig implements WebMvcConfigurer {
  
      // ...
  
      @Override
      public void addCorsMappings(CorsRegistry registry) {
          LogManager.getLogger(getClass()).info("CORS settings");
          registry.addMapping("/api/**").allowedOrigins("*").maxAge(3600);
      }
  </code></pre>
  
  <p>CORS requests fail, and I get (in Firefox, Chrome shows a similar error message):</p>
  
  <pre><code>CORS header 'Access-Control-Allow-Origin' missing
  </code></pre>
  
  <p>I see the log entry, so the method is surely invoked.</p>
  
  <p>I've seen other questions mentioning Spring Security or Spring Data (I use none), so here's my dependencies list in case I'm missing something:</p>
  
  <ul>
  <li>spring-boot-starter-web</li>
  <li>spring-boot-starter-tomcat</li>
  <li>spring-boot-starter-log4j2</li>
  <li>spring-boot-configuration-processor</li>
  <li>commons-lang3</li>
  <li>commons-beanutils</li>
  </ul>
  
  <p>What's the right way to set CORS settings to the whole application, without using the <code>@CrossOrigin</code> annotation on each controller?</p>
  
  <h1>UPDATE</h1>
  
  <p>I'm initializing a Rest servlet like this:</p>
  
  <pre><code>@Bean
  public ServletRegistrationBean&lt;DispatcherServlet&gt; registerDispatcherServlet(DispatcherServlet servlet) {
      ServletRegistrationBean&lt;DispatcherServlet&gt; registration = new ServletRegistrationBean&lt;&gt;(servlet);
  
      servlet.setContextConfigLocation("");
      registration.addUrlMappings("/api/*");
      registration.setLoadOnStartup(1);
  
      return registration;
  }
  </code></pre>
  
  <p>The logs says:</p>
  
  <pre><code>Servlet dispatcherServlet mapped to [/api/*]
  Servlet dispatcherServlet mapped to [/]
  Servlet dispatcherServlet was not registered (possibly already registered?)
  </code></pre>
  
  <p>Could it be that the given Cors settings are going to the mentioned unregistered servlet?</p>