When constructing a test for CORS in MockMvc, and allowing output to be printed, the printed representation of the MockHttpServletResponse incorrectly contains entries for Access-Control-Request-Method and Access-Control-Request-Headers. These headers are request headers and are printed here no matter if we include them in the input request or not. Below is the printout from an OPTIONS request with Origin and Access-Control-Request-Method headers only set.
MockHttpServletResponse:
Status = 200
Error message = null
Headers = [Vary:"Origin", "Access-Control-Request-Method", "Access-Control-Request-Headers", Access-Control-Allow-Origin:"http://localhost:3000", Access-Control-Allow-Methods:"GET,PUT,POST,PATCH,HEAD,OPTIONS,DELETE", Access-Control-Allow-Credentials:"true", Access-Control-Max-Age:"1800", X-Content-Type-Options:"nosniff", X-XSS-Protection:"1; mode=block", Cache-Control:"no-cache, no-store, max-age=0, must-revalidate", Pragma:"no-cache", Expires:"0", X-Frame-Options:"DENY"]
Content type = null
Body =
However, these headers are not included in the final result because if we add to the test
...
.andExpect(MockMvcResultMatchers.header().doesNotExist("Access-Control-Request-Method"))
.andExpect(MockMvcResultMatchers.header().doesNotExist("Access-Control-Request-Headers"))
... it still passes. Nonetheless, it is confusing that these headers are listed in the printout. TO be clear, these headers should not be listed there (no matter if they're included in the request or not).
Behaviour verified on Spring Boot 2.6.0 with
mvc.perform(
MockMvcRequestBuilders
.options(<PATH>)
.header("Access-Control-Request-Method", "GET")
.header("Origin", <ORIGIN>)
)
Comment From: rstoyanchev
Those are not response headers. They are names of request headers listed in the value of the "Vary" response header to aid clients and proxies with request caching. It is built-in, expected behavior of DefaultCorsProcessor and unrelated to MockMvc.
Comment From: fast-reflexes
So why are they listed LITERALLY under MockHttpServletResponse? I don't think that's very intuitive ...