Add the cors-csrf module

cors-csrf/docs/output/03-security-source.txt

@@ -0,0 +1,36 @@
+==============================================================================
+docs/output/03-security-source.txt
+A @Bean named corsConfigurationSource. .cors(..) is never called - it is applied for us.
+Profile: securitysource
+==============================================================================
+
+$ curl -s localhost:8080/diag/cors-sources
+{
+    "corsConfigurationSourceBeans": {
+        "corsConfigurationSource": "UrlBasedCorsConfigurationSource",
+        "mvcHandlerMappingIntrospector": "HandlerMappingIntrospector"
+    },
+    "hasBeanNamedCorsConfigurationSource": true
+}
+
+$ curl -s -i -X OPTIONS http://localhost:8080/api/data \
+    -H 'Origin: https://spa.example.com' \
+    -H 'Access-Control-Request-Method: POST' \
+    -H 'Access-Control-Request-Headers: content-type,x-xsrf-token'
+
+HTTP/1.1 200 
+Vary: Origin
+Vary: Access-Control-Request-Method
+Vary: Access-Control-Request-Headers
+Access-Control-Allow-Origin: https://spa.example.com
+Access-Control-Allow-Methods: GET,POST
+Access-Control-Allow-Headers: content-type, x-xsrf-token
+Access-Control-Allow-Credentials: true
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+
+# Compare with 02: there is no Access-Control-Max-Age here. CorsConfiguration
+# leaves maxAge null, so every single cross-origin call re-runs the preflight.