Add the cors-csrf module

cors-csrf/docs/output/01-mvc-only.txt

@@ -0,0 +1,58 @@
+==============================================================================
+docs/output/01-mvc-only.txt
+CORS configured with WebMvcConfigurer.addCorsMappings and nothing else.
+Profile: mvconly
+==============================================================================
+
+# The security chain. Note what is NOT in it.
+$ curl -s localhost:8080/diag/chain
+{
+    "profiles": [
+        "mvconly"
+    ],
+    "chains": [
+        {
+            "size": 11,
+            "filters": [
+                "DisableEncodeUrlFilter",
+                "WebAsyncManagerIntegrationFilter",
+                "SecurityContextHolderFilter",
+                "HeaderWriterFilter",
+                "LogoutFilter",
+                "BasicAuthenticationFilter",
+                "RequestCacheAwareFilter",
+                "SecurityContextHolderAwareRequestFilter",
+                "AnonymousAuthenticationFilter",
+                "ExceptionTranslationFilter",
+                "AuthorizationFilter"
+            ]
+        }
+    ]
+}
+
+# CorsConfigurationSource beans in the context.
+$ curl -s localhost:8080/diag/cors-sources
+{
+    "corsConfigurationSourceBeans": {
+        "mvcHandlerMappingIntrospector": "HandlerMappingIntrospector"
+    },
+    "hasBeanNamedCorsConfigurationSource": false
+}
+
+$ curl -s -i -X OPTIONS http://localhost:8080/api/data \
+    -H 'Origin: https://spa.example.com' \
+    -H 'Access-Control-Request-Method: POST' \
+    -H 'Access-Control-Request-Headers: content-type,x-xsrf-token'
+
+HTTP/1.1 401 
+Set-Cookie: JSESSIONID=<session>; Path=/; HttpOnly; SameSite=Lax
+WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+
+# The MVC CORS mapping is real - it just never runs, because the request is
+# rejected at AuthorizationFilter (order 4200) and the DispatcherServlet is
+# downstream of the entire filter chain.