Where do I put the Authentication Filter for Spring Boot 1.3.3 - angularjs

Question

So I know what the problem is, I just don't know how to fix it.
Problem
I am using Spring Boot 1.3.3 and the CorsFilter is set like the following
public class WebConfig extends WebMvcConfigurerAdapter {
#Autowired
private Environment env;
#Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins("http://192.168.1.132:8100")
.allowedHeaders("Accept", "Content-Type","X-Auth-Token", "Origin", "Pragma","Cache-Control",
"If-Modified-Since","Authorization")
.exposedHeaders("X-Auth-Token")
.allowedMethods("PUT","POST","GET","OPTIONS")
.allowCredentials(true).maxAge(3600);
}
}
Secuity Config
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http
.authorizeRequests()
.antMatchers("/save-user","/test","/error","/login").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.permitAll()
.and()
.logout()
.permitAll();
http.addFilterAfter(new CustomStatelessAuthenticationFilter(tokenAuthenticationService),
UsernamePasswordAuthenticationFilter.class);
...
}
The problem I am having is that I am using a Custom Token something like X-Auth-Token to validate the user. BUT CustomStatelessAuthenticationFilter is being called before the CorsRegistry. Before Chrome makes a call it does a OPTIONS call to make sure the application is legit. It won't allow me to pass the X-AUTH-TOKEN header without validating the call is legit. So it does not allow me to pass the X-AUTH-TOKEN until the server gets a response status OK From the server. Well since the CustomStatelessAuthenticationFilter gets call first, the X-AUTH-TOKEN returns as null. To fix this I had to do something like this...
CustomStatelessAuthenticationFilter
#Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
boolean debug = this.logger.isDebugEnabled();
if(debug) {
this.logger.debug("Custom.Custom Stateless Authentication");
}
if (request.getMethod().equals("OPTIONS")) {
response.addHeader("Access-Control-Allow-Origin", "http://192.168.1.132:8100");
response.addHeader("Access-Control-Allow-Headers", "X-Auth-Token");
response.addHeader("Access-Control-Expose-Headers", "X-Auth-Token");
response.setStatus(HttpServletResponse.SC_OK);
} else {
SecurityContextHolder.getContext().setAuthentication(
this.tokenAuthenticationService.getAuthentication((HttpServletRequest) request));
filterChain.doFilter(request, response);
}
}
In other words I have to return to the client that Status is OK manually before it will make the real request. It makes two request, one to make sure the OPTION call returns a OK (Pre Flight Request), then it makes another that actually makes the call with the X-Auth-Token in it. I don't want to do this because its completely ignoring my CorsMapping. I want it to check the CorsMapping First before continuing on. So where do I setup the authenitcation correctly so it already accepts the OPTIONS check first before actually authenticating.
I've also tried something like the following in my security config
http.addFilterAfter(new CustomStatelessAuthenticationFilter(tokenAuthenticationService),
CsrfFilter.class);
I advise a Upvote for this because I have not found a solid solution. So far the addCorsMappings has cause me more of a pain than the older solution of just adding a CorsFilter in older versions