Add the cors-csrf module

cors-csrf/scripts/run.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Start the demo application under a given profile and wait until it answers.
+#
+#   ./scripts/run.sh securitysource
+#   ./scripts/run.sh mvconly
+#   SESSION_SAME_SITE=none SESSION_SECURE=false ./scripts/run.sh crosssite
+#   JVM_ARGS=-DOMIT_SECURE=true ./scripts/run.sh crosssite
+#   CSRF_LOG_LEVEL=DEBUG ./scripts/run.sh csrfnaive
+#
+# Two profiles are expected to FAIL to start - `misnamed` and `preflightclash`. That is what
+# they demonstrate, so this script returns 1 for them and the transcript keeps the exception.
+set -eu
+cd "$(dirname "$0")/.."
+
+PROFILE="${1:-securitysource}"
+LOG="${LOG:-/tmp/cors-csrf-app.log}"
+
+./scripts/stop.sh
+
+setsid nohup mvn -B org.springframework.boot:spring-boot-maven-plugin:run \
+  -Dspring-boot.run.profiles="$PROFILE" \
+  -Dspring-boot.run.jvmArguments="${JVM_ARGS:-}" \
+  > "$LOG" 2>&1 < /dev/null &
+
+for _ in $(seq 1 90); do
+  if curl -sf -o /dev/null http://localhost:8080/diag/chain 2>/dev/null; then
+    echo "started with profile: $PROFILE (log: $LOG)"
+    exit 0
+  fi
+  if grep -q 'APPLICATION FAILED TO START' "$LOG" 2>/dev/null; then
+    echo "application failed to start under profile: $PROFILE (log: $LOG)" >&2
+    exit 1
+  fi
+  sleep 2
+done
+echo "application did not become ready; see $LOG" >&2
+exit 1