MCP Server CORS outages fixed

Short summary

CORS preflight requests fail in MCP servers when authentication filters execute before CORS filters, causing OPTIONS requests to be rejected with 403 before CORS headers are added to the response. The solution: run CorsFilter with Ordered.HIGHEST_PRECEDENCE and explicitly skip authentication for OPTIONS preflight requests, which don't require credentials. Includes complete, production-tested Spring Boot configuration code.

• •Filter ordering mistake: auth filter running before CORS filter blocks preflight OPTIONS requests with 403
• •Fix requires CorsFilter at highest precedence and explicitly skipping OPTIONS in authentication filter
• •Complete copy-paste Spring Boot configuration with working code examples

Generated with AI, which can make mistakes.