Polish

spring-webmvc/src/main/resources/org/springframework/web/servlet/config/spring-mvc.xsd

@@ -1310,8 +1310,11 @@
 					<xsd:annotation>
 						<xsd:documentation><![CDATA[
 	Enable cross origin requests processing on the specified path pattern.
-	By default, all origins, GET HEAD POST methods, all headers and credentials
-	are allowed and max age is set to 30 minutes.
+	The following defaults are applied to the resulting CorsRegistration:
+	 - Allow all origins.
+	 - Allow "simple" methods {@code GET}, {@code HEAD} and {@code POST}.
+	 - Allow all headers.
+	 - Set max age to 1800 seconds (30 minutes).
 						]]></xsd:documentation>
 					</xsd:annotation>
 					<xsd:complexType>
@@ -1361,7 +1364,19 @@
 						<xsd:attribute name="allow-credentials" type="xsd:boolean">
 							<xsd:annotation>
 								<xsd:documentation><![CDATA[
-	Whether user credentials are supported (true by default).
+	Whether the browser should send credentials, such as cookies along with
+	cross domain requests, to the annotated endpoint. The configured value is
+	set on the "Access-Control-Allow-Credentials" response header of
+	preflight requests.
+
+	NOTE: Be aware that this option establishes a high
+	level of trust with the configured domains and also increases the surface
+	attack of the web application by exposing sensitive user-specific
+	information such as cookies and CSRF tokens.
+
+	By default this is not set in which case the
+	"Access-Control-Allow-Credentials" header is also not set and
+	credentials are therefore not allowed.
 								]]></xsd:documentation>
 							</xsd:annotation>
 						</xsd:attribute>