CORS的预检请求使用不带凭据的HTTP OPTIONS，请参见

CORS' preflight request uses HTTP OPTIONS without credentials, see Cross-Origin Resource Sharing:

否则，请发出预检请求.使用引荐来源作为覆盖引荐来源，并使用方法OPTIONS并设置以下附加约束，将引荐来源作为覆盖引荐来源，从来源来源开始获取请求URL:

Otherwise, make a preflight request. Fetch the request URL from origin source origin using referrer source as override referrer source with the manual redirect flag and the block cookies flag set, using the method OPTIONS, and with the following additional constraints:

• 包括一个Access-Control-Request-Method标头，并将请求方法作为标头字段值(即使是简单方法也是如此).
• 如果作者请求标头不为空，则包括一个Access-Control-Request-Headers标头，并以字母顺序按作者顺序将作者请求标头的标头字段名称列表以逗号分隔，作为标头字段值，每个都转换为ASCII小写字母(甚至如果一个或多个是一个简单的标头).
• 排除作者请求标头.
• 排除用户凭据.
• 排除请求实体主体.

• Include an Access-Control-Request-Method header with as header field value the request method (even when that is a simple method).
• If author request headers is not empty include an Access-Control-Request-Headers header with as header field value a comma-separated list of the header field names from author request headers in lexicographical order, each converted to ASCII lowercase (even when one or more are a simple header).
• Exclude the author request headers.
• Exclude user credentials.
• Exclude the request entity body.

您必须允许HTTP OPTIONS的匿名访问.

You have to allow anonymous access for HTTP OPTIONS.

您修改(简化)的代码:

Your modified (and simplified) code:

@Override
protected void configure(HttpSecurity http) throws Exception {
   http
       .authorizeRequests()
           .andMatchers(HttpMethod.OPTIONS, "/**").permitAll()
           .antMatchers("/login").permitAll()
           .anyRequest().fullyAuthenticated()
           .and()
       .httpBasic()
           .and()
       .sessionManagement()
           .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
           .and()
       .csrf().disable();
}

从Spring Security 4.2.0开始，您可以使用内置支持，请参见

Since Spring Security 4.2.0 you can use the built-in support, see Spring Security Reference:

19. CORS

Spring框架为CORS提供了一流的支持.必须在Spring Security之前处理CORS，因为飞行前请求将不包含任何cookie(即JSESSIONID).如果请求中不包含任何cookie，并且首先使用Spring Security，则该请求将确定用户未通过身份验证(因为请求中没有cookie)，并拒绝该用户.

Spring Framework provides first class support for CORS. CORS must be processed before Spring Security because the pre-flight request will not contain any cookies (i.e. the JSESSIONID). If the request does not contain any cookies and Spring Security is first, the request will determine the user is not authenticated (since there are no cookies in the request) and reject it.

确保首先处理CORS的最简单方法是使用CorsFilter.用户可以使用以下内容提供CorsConfigurationSource来将CorsFilter与Spring Security集成:

The easiest way to ensure that CORS is handled first is to use the CorsFilter. Users can integrate the CorsFilter with Spring Security by providing a CorsConfigurationSource using the following:

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          // by default uses a Bean by the name of corsConfigurationSource
          .cors().and()
          ...
  }

  @Bean
  CorsConfigurationSource corsConfigurationSource() {
      CorsConfiguration configuration = new CorsConfiguration();
      configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
      configuration.setAllowedMethods(Arrays.asList("GET","POST"));
      UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
      source.registerCorsConfiguration("/**", configuration);
      return source;
  }
}