When constructing a test for CORS in MockMvc, and allowing output to be printed, the printed representation of the MockHttpServletResponse incorrectly contains entries for Access-Control-Request-Method and Access-Control-Request-Headers. These headers are request headers and are printed here no matter if we include them in the input request or not. Below is the printout from an OPTIONS request with Origin and Access-Control-Request-Method headers only set.

MockHttpServletResponse:
    Status = 200
    Error message = null
    Headers = [Vary:"Origin", "Access-Control-Request-Method", "Access-Control-Request-Headers", Access-Control-Allow-Origin:"http://localhost:3000", Access-Control-Allow-Methods:"GET,PUT,POST,PATCH,HEAD,OPTIONS,DELETE", Access-Control-Allow-Credentials:"true", Access-Control-Max-Age:"1800", X-Content-Type-Options:"nosniff", X-XSS-Protection:"1; mode=block", Cache-Control:"no-cache, no-store, max-age=0, must-revalidate", Pragma:"no-cache", Expires:"0", X-Frame-Options:"DENY"]
    Content type = null
    Body =

However, these headers are not included in the final result because if we add to the test

...
.andExpect(MockMvcResultMatchers.header().doesNotExist("Access-Control-Request-Method"))
.andExpect(MockMvcResultMatchers.header().doesNotExist("Access-Control-Request-Headers"))

... it still passes. Nonetheless, it is confusing that these headers are listed in the printout. TO be clear, these headers should not be listed there (no matter if they're included in the request or not).

Behaviour verified on Spring Boot 2.6.0 with

mvc.perform(
    MockMvcRequestBuilders
        .options(<PATH>)
        .header("Access-Control-Request-Method", "GET")
        .header("Origin", <ORIGIN>)
)

Comment From: rstoyanchev

Those are not response headers. They are names of request headers listed in the value of the "Vary" response header to aid clients and proxies with request caching. It is built-in, expected behavior of DefaultCorsProcessor and unrelated to MockMvc.

Comment From: fast-reflexes

So why are they listed LITERALLY under MockHttpServletResponse? I don't think that's very intuitive ...