When constructing a test for CORS in MockMvc, and allowing output to be printed, the printed representation of the MockHttpServletResponse
incorrectly contains entries for Access-Control-Request-Method
and Access-Control-Request-Headers
. These headers are request headers and are printed here no matter if we include them in the input request or not. Below is the printout from an OPTIONS
request with Origin
and Access-Control-Request-Method
headers only set.
MockHttpServletResponse:
Status = 200
Error message = null
Headers = [Vary:"Origin", "Access-Control-Request-Method", "Access-Control-Request-Headers", Access-Control-Allow-Origin:"http://localhost:3000", Access-Control-Allow-Methods:"GET,PUT,POST,PATCH,HEAD,OPTIONS,DELETE", Access-Control-Allow-Credentials:"true", Access-Control-Max-Age:"1800", X-Content-Type-Options:"nosniff", X-XSS-Protection:"1; mode=block", Cache-Control:"no-cache, no-store, max-age=0, must-revalidate", Pragma:"no-cache", Expires:"0", X-Frame-Options:"DENY"]
Content type = null
Body =
However, these headers are not included in the final result because if we add to the test
...
.andExpect(MockMvcResultMatchers.header().doesNotExist("Access-Control-Request-Method"))
.andExpect(MockMvcResultMatchers.header().doesNotExist("Access-Control-Request-Headers"))
... it still passes. Nonetheless, it is confusing that these headers are listed in the printout. TO be clear, these headers should not be listed there (no matter if they're included in the request or not).
Behaviour verified on Spring Boot 2.6.0 with
mvc.perform(
MockMvcRequestBuilders
.options(<PATH>)
.header("Access-Control-Request-Method", "GET")
.header("Origin", <ORIGIN>)
)
Comment From: rstoyanchev
Those are not response headers. They are names of request headers listed in the value of the "Vary"
response header to aid clients and proxies with request caching. It is built-in, expected behavior of DefaultCorsProcessor
and unrelated to MockMvc.
Comment From: fast-reflexes
So why are they listed LITERALLY under MockHttpServletResponse
? I don't think that's very intuitive ...