quarkus: CORS should return correct headers even if an authorization header is wrong

Describe the bug When CORS is enabled and “authorization” header is present and incorrect (wrong username and/or password), CORS filter does not return proper headers and browser doesn’t even get HTTPS 401 because the response is rejected by the CORS policy.

Expected behavior I guess we should add CORS filter BEFORE security check.

Actual behavior Security (username/password) is verified before CORS even if endpoint contains @PermitAll annotation.

To Reproduce I created a small Quarkus+ReactJS application, you can clone it from here: https://github.com/belyaev-andrey/quarkus-security-cors, tested for localhost only.

• Run quarkus backend by executing mvn compile quarkus:dev
• Run ReactJS client by executing npm start in ./client folder
• Open browser for http://localhost:3000 address
• Click on Hello secured incorrect password button
• See Access to fetch at 'http://localhost:8080/api/admin' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled. log entry in browser’s console.
• You can check that it doesn’t work for endpoints with anonymous access if you change line 16 in App.js file and use 'hello' endpoint instead of 'admin'.

Environment (please complete the following information):

• Output of uname -a or ver: Microsoft Windows [Version 10.0.18362.10014]
• Output of java -version:

java version "10.0.2" 2018-07-17
Java(TM) SE Runtime Environment 18.3 (build 10.0.2+13)
Java HotSpot(TM) 64-Bit Server VM 18.3 (build 10.0.2+13, mixed mode)

• GraalVM version (if different from Java): N/A
• Quarkus version or git rev: 0.21.1