Why does @CrossOrigin on a controller sometimes still fail with Spring Security enabled?

Spring Security's filter chain processes (and can reject) requests BEFORE they ever reach your Spring MVC controller, where @CrossOrigin is evaluated. If Spring Security itself isn't configured with a matching CorsConfigurationSource via http.cors(...), the security layer may block or mishandle the request/preflight before MVC-level CORS handling ever gets a chance to run.