From b77f6cead7fe879ee23858dd3d7c2d6393fc1db5 Mon Sep 17 00:00:00 2001 From: Oliver Drotbohm Date: Mon, 9 Jan 2023 16:41:48 +0100 Subject: [PATCH] Additional test cases for default CORS setup on repositories. We now also assert on the Access-Control-Allow-Origin to default to * in case no more detailed configuration was set up. Issue #2208. --- .../jpa/LocalConfigCorsIntegrationTests.java | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/spring-data-rest-tests/spring-data-rest-tests-jpa/src/test/java/org/springframework/data/rest/webmvc/jpa/LocalConfigCorsIntegrationTests.java b/spring-data-rest-tests/spring-data-rest-tests-jpa/src/test/java/org/springframework/data/rest/webmvc/jpa/LocalConfigCorsIntegrationTests.java index d5f958949..7dfa3cdee 100755 --- a/spring-data-rest-tests/spring-data-rest-tests-jpa/src/test/java/org/springframework/data/rest/webmvc/jpa/LocalConfigCorsIntegrationTests.java +++ b/spring-data-rest-tests/spring-data-rest-tests-jpa/src/test/java/org/springframework/data/rest/webmvc/jpa/LocalConfigCorsIntegrationTests.java @@ -24,7 +24,6 @@ import org.springframework.context.annotation.Bean; import org.springframework.data.rest.tests.AbstractWebIntegrationTests; import org.springframework.data.rest.webmvc.RepositoryRestHandlerMapping; import org.springframework.data.rest.webmvc.config.RepositoryRestConfigurer; -import org.springframework.hateoas.Link; import org.springframework.hateoas.LinkRelation; import org.springframework.http.HttpHeaders; import org.springframework.http.HttpMethod; @@ -50,19 +49,20 @@ class LocalConfigCorsIntegrationTests extends AbstractWebIntegrationTests { /** * @see ItemRepository */ - @Test // DATAREST-1397 + @Test // DATAREST-1397, #2208 void appliesRepositoryCorsConfiguration() throws Exception { - Link findItems = client.discoverUnique(LinkRelation.of("items")); + var findItems = client.discoverUnique(LinkRelation.of("items")); // Preflight request - String header = mvc - .perform(options(findItems.expand().getHref()).header(HttpHeaders.ORIGIN, "http://far.far.example") - .header(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, "POST")) // - .andExpect(status().isOk()) // - .andReturn().getResponse().getHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS); + var request = options(findItems.expand().getHref()) // + .header(HttpHeaders.ORIGIN, "https://far.far.example") // + .header(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, "POST"); - assertThat(header.split(",")) + var response = mvc.perform(request).andExpect(status().isOk()).andReturn().getResponse(); + + assertThat(response.getHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN)).isEqualTo("*"); + assertThat(response.getHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS).split(",")) .containsExactlyInAnyOrderElementsOf( RepositoryRestHandlerMapping.DEFAULT_ALLOWED_METHODS.map(HttpMethod::name)); }