mirror of
https://github.com/spring-projects/spring-boot.git
synced 2026-10-01 14:59:50 +00:00
Andy Wilkinson
d2b62bc64f
Previously, Spring Security wouldn't necessary allow cross-origin requests to /cloudfoundryapplication, despite the underlying handler mapping doing so. Since 6.2, Spring Security enables CORS with default configuration if there are any UrlBasedCorsConfigurationSource beans in the context. This default configuration will then use a bean named corsConfigurationSource as its source of CORS configuration. If it doesn't find such a bean, it'll use the mvcHandlerMappingIntrospector bean as a source. This latter case works as it means that the CORS configuration of the underlying handler mapping is used. In the case where a bean named corsConfigurationSource is used, this will break /cloudfoundryapplication if the bean's CORS configuration for /cloudfoundryapplication does not allow it. This has only been a problem since Spring Boot 3.5 where we switched from using ignoring() to using permitAll() to configure the security of /cloudfoundryapplication. To avoid a user-provided bean named corsConfigurationSource from accidentally preventing access to /cloudfoundryapplication, we now explicitly configure the filter chain's CORS support to use the same CorsConfigurationSource as the handler mapping. Fixes gh-50254