CORS preview feed failed with Spring Security

I am creating an Angular 2 app with a Spring backend. I have been trying to resolve a CORS pre-field issue for several days. According to this thread , it should work with a CORS filter like this:

@Component
public class CorsFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "authorization, content-type, xsrf-token");
        response.addHeader("Access-Control-Expose-Headers", "xsrf-token");
        if ("OPTIONS".equals(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else { 
            filterChain.doFilter(request, response);
        }
    }
}


@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends    ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
        .addFilterBefore(new CorsFilter(), ChannelProcessingFilter.class)
        .headers()
            .frameOptions().disable()
            .and()
        .authorizeRequests()
            .antMatchers("/", "/home", "/register", "/login").permitAll()
            .antMatchers("/cottages").authenticated();
    }
}

      

        
        
        
      

    

Angular frontend:

  import {Injectable} from '@angular/core';
  import {Headers, Http} from "@angular/http";
  import {AppSettings} from "../app.settings";
  import { URLSearchParams } from '@angular/http'

  import {User} from "../_models/_index";
  import {Observable} from "rxjs";

  @Injectable()
  export class AuthenticationService {
   private headers = new Headers({'Content-Type': 'application/json'});
  private tokenHeaders = new Headers({
 'Content-Type': 'application/json',
 'client_id': 'xxx',
 'client_secret': 'xxx'});


constructor(private http: Http) {
}


login(user: User) {
let urlSearchParams = new URLSearchParams();
urlSearchParams.append('username', user.username);
urlSearchParams.append('password', user.password);
let body = urlSearchParams.toString();

return this.http.post(AppSettings.getApiUrl() + "oauth/token", body, { withCredentials: true, headers: this.tokenHeaders })
  .map((responseData) => {
    return responseData.json();
  })
  .map((item: any) => {
    return new User(item);
  })
  .catch((error: any) => Observable.of(error.json().error || 'Server error'));

 }
}

      

        
        
        
      

    

I tried a different configuration I found on this and other sources from the Spring docs.

I always get this error message:

Cross-origin request blocked: Same origin policy prevents reading the remote resource at http: // localhost: 8080 / oauth / token . (Reason: CORS preview channel failed).

A simple CORS request to my own controller, for example for user registration, works fine.

Can someone explain to me what I am doing wrong? Is there a bug in the Java or Typescript code?

Edit:

Authorization server configuration:

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends     AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().withClient("my-trusted-client").authorizedGrantTypes("client_credentials", "password")
            .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT").scopes("read", "write", "trust")
            .resourceIds("oauth2-resource").accessTokenValiditySeconds(5000).secret("xxx");
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security.checkTokenAccess("isAuthenticated()");
     }
}