**CORS error in SPring boot 3.x mvc Apigateway and Augular 16 UI

UI calls Api gateway and both are different domains. Preflight Request is successful with status 200. However subsequent request I am getting status CORS error ” CORS error header disallowedbyPreflightResponse” My api gateway is build in spring boot 3.3**

Preflight Request header in browser

• authority = exchange-api-gateway.com
• :method = OPTIONS
• :path = /v1/alerts/count
• :scheme: https
• Accept : /
• Accept-Encoding = gzip, deflate, br, zstd
• Accept-Language: en-US,en;q=0.9
• Accept-Control-Request-Headers: authorization, Channel-Type, content-type
• Accept-Control-Request-Method: GET
• Origin: https://example.com
• Priority: u=1,I
• Referer: https://example.com
• Sec-Fetch-Dest: empty
• Sec-Fech-Mode: cors

Preflight Response header in browser

• Access-Control-Allow-Credential: true
• Access-Control-Allow-Headers = *
• Access-Control-Allow-methods = *
• Access-Control-Allow-Origin= “https://example.com”
• Access-Control-Expose-Headers : *
• Cache-Control: no-cache, max-age=0,private
• Content-Length = 0
• Date :
• Expires = 0
• Vary: Origin
• Vary = Access-Control-Request-Method
• Vary= Access-Control-Request-Headers
• X-Content-Type-Options = nosniff
• X-Frame-Options = Deny
• X-xss-Protection = 1;mode=block

@Order(1)
public class CorsFilter implements Filter {

     @Override
     public void doFilter(servletRequest,servletResponse,filterChain)
     {
       HttpServletRequest request = (HttpServletRequest) servletRequest;
       HttpServletResponse response = (HttpServletResponse)servletResponse
       response.addHeader("Access-Control-Allow-Origin","https://example.com");
       response.addHeader("Access-Control-Allow-Headers","*");
       response.addHeader("Access-Control-Allow-Credentials","true");
       response.addHeader("Refer-Policy","strict-origin-when-cross-origin");
       response.addHeader("Access-Control-Expose-Headers","X-maintainance");// tried with "*" 
       filterChain.doChain(request,response)
     }

}

I tried to use below code too

@Override
public void addCorsMappings(CorsRegistry registry) {
    registry.addMapping("/**")
            .allowedOrigins("https://example.com")
            .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
            .allowedHeaders("authorization", "content-type", "x-custom-header") // tried with *
            .allowCredentials(true)
            .exposedHeaders("x-custom-header")// tried with * 
    

        .maxAge(3600); // 1 hour
}