Scenario 1: Your Angular app on localhost:4200 gets a CORS error calling your Spring Boot API on localhost:8080, but Postman works fine calling the same endpoint. Why, and how do you fix it?

Postman doesn't enforce CORS (it's a browser-only mechanism), which is why it works while the browser blocks the call. The fix is server-side: configure a CorsConfigurationSource with the exact allowed origin (http://localhost:4200), allowed methods, and headers, and wire it into Spring Security via http.cors(...) — not just @CrossOrigin on the controller, since Spring Security's filter chain runs first and can independently block the request or its preflight.