Add the cors-csrf module

cors-csrf/docs/output/05-misnamed-bean.txt

@@ -0,0 +1,39 @@
+==============================================================================
+docs/output/05-misnamed-bean.txt
+The same UrlBasedCorsConfigurationSource bean, named apiCorsSource instead of
+corsConfigurationSource. It starts. The preflight returns 200. It carries no CORS headers.
+Profile: misnamed
+==============================================================================
+
+$ curl -s localhost:8080/diag/cors-sources
+{
+    "corsConfigurationSourceBeans": {
+        "apiCorsSource": "UrlBasedCorsConfigurationSource",
+        "mvcHandlerMappingIntrospector": "HandlerMappingIntrospector"
+    },
+    "hasBeanNamedCorsConfigurationSource": false
+}
+
+$ curl -s -i -X OPTIONS http://localhost:8080/api/data \
+    -H 'Origin: https://spa.example.com' \
+    -H 'Access-Control-Request-Method: POST' \
+    -H 'Access-Control-Request-Headers: content-type,x-xsrf-token'
+
+HTTP/1.1 200 
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+
+<timestamp> DEBUG <pid> --- [cors-csrf-samesite] [nio-8080-exec-N] o.s.web.cors.DefaultCorsProcessor        : Skip: no CORS configuration has been provided
+
+# Two different lookups. HttpSecurityConfiguration.applyCorsIfAvailable asks
+# getBeanNamesForType(UrlBasedCorsConfigurationSource.class) and enables CORS if the
+# array is non-empty, so the bean above DID switch the configurer on.
+# CorsConfigurer.getCorsConfigurationSource then asks
+# containsBeanDefinition("corsConfigurationSource"), which is false, and falls back
+# to Spring MVC's registrations - of which there are none.
+# CorsFilter returns from every preflight whether or not it found a configuration:
+#   if (!isValid || CorsUtils.isPreFlightRequest(request)) { return; }
+# so the OPTIONS never reaches AuthorizationFilter and the client gets a bare 200.