Bug Report

Describe the Bug

This is the same underlying problem as #5968: ServicePrincipalAuthenticationFilter should bypass authentication for OPTIONS requests, just like JwtValidatorFilter already does.

ServicePrincipalAuthenticationFilter requires the claims request property to be present:

...whereas JwtValidatorFilter already has an explicit OPTIONS bypass:

Expected Behavior

OPTIONS requests should bypass authentication in AuthenticationRequestFilter, so that CORS preflight requests succeed with a 2xx response.

Observed Behavior

A CORS preflight request receives a 401, which browsers report as:

Access to fetch at '...' from origin '...' has been blocked by CORS
policy: Response to preflight request doesn't pass access control
check: It does not have HTTP ok status.

Steps to Reproduce

1. Enable the Management API OAuth2 authentication extension (edc.iam.oauth2.issuer, edc.iam.oauth2.jwks.url) together with CORS (edc.web.rest.cors.enabled=true).
2. Send a CORS preflight request:

   curl -i 'http://localhost:8192/management/v5/participants/participant1/contractnegotiations/request' \
     -X OPTIONS \
     -H 'Origin: http://localhost:4201' \
     -H 'Access-Control-Request-Method: POST' \
     -H 'Access-Control-Request-Headers: authorization,content-type'
   

Response:
HTTP/1.1 401 Unauthorized
Access-Control-Allow-Origin: http://localhost:4201
Access-Control-Allow-Headers: Origin,Content-Type,Accept,Authorization,X-Api-Key
Access-Control-Allow-Methods: GET,POST,PUT,PATCH,DELETE,OPTIONS
Cache-Control: must-revalidate,no-cache,no-store
Content-Length: 0

Context Information

Used version: 1.0.0-RC4
OS: Linux

Possible Implementation

@Override
public void filter(ContainerRequestContext containerRequestContext) {
    if ("OPTIONS".equalsIgnoreCase(containerRequestContext.getMethod())) {
        return;
    }

    var claims = containerRequestContext.getProperty(REQUEST_PROPERTY_CLAIMS);
    // ... rest of the existing logic unchanged
}