Add the cors-csrf module

cors-csrf/docs/output/06-two-sources.txt

@@ -0,0 +1,44 @@
+==============================================================================
+docs/output/06-two-sources.txt
+Two UrlBasedCorsConfigurationSource beans. The reference documentation says Spring Security
+'won't automatically configure CORS support for you, because it cannot decide which one to
+use'. In 7.1.1 it configures it, and the bean NAME decides.
+Profile: twosources
+==============================================================================
+
+{
+    "corsConfigurationSourceBeans": {
+        "corsConfigurationSource": "UrlBasedCorsConfigurationSource",
+        "adminCorsSource": "UrlBasedCorsConfigurationSource",
+        "mvcHandlerMappingIntrospector": "HandlerMappingIntrospector"
+    },
+    "hasBeanNamedCorsConfigurationSource": true
+}
+
+# the origin allowed by the bean named corsConfigurationSource:
+HTTP/1.1 200 
+Vary: Origin
+Vary: Access-Control-Request-Method
+Vary: Access-Control-Request-Headers
+Access-Control-Allow-Origin: https://spa.example.com
+Access-Control-Allow-Methods: GET,POST
+Access-Control-Allow-Headers: content-type
+Access-Control-Allow-Credentials: true
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+
+# the origin allowed by adminCorsSource, which is never consulted:
+HTTP/1.1 403 
+Vary: Origin
+Vary: Access-Control-Request-Method
+Vary: Access-Control-Request-Headers
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+
+<timestamp> DEBUG <pid> --- [cors-csrf-samesite] [nio-8080-exec-N] o.s.web.cors.DefaultCorsProcessor        : Reject: 'https://admin.example.com' origin is not allowed