Maybe try using org.springframework.web.cors.reactive.CorsConfigurationSource instead of the servlet-based UrlBasedCorsConfigurationSource
org.springframework.web.cors.reactive.CorsConfigurationSource
UrlBasedCorsConfigurationSource