==============================================================================
docs/output/01-mvc-only.txt
CORS configured with WebMvcConfigurer.addCorsMappings and nothing else.
Profile: mvconly
==============================================================================

# The security chain. Note what is NOT in it.
$ curl -s localhost:8080/diag/chain
{
    "profiles": [
        "mvconly"
    ],
    "chains": [
        {
            "size": 11,
            "filters": [
                "DisableEncodeUrlFilter",
                "WebAsyncManagerIntegrationFilter",
                "SecurityContextHolderFilter",
                "HeaderWriterFilter",
                "LogoutFilter",
                "BasicAuthenticationFilter",
                "RequestCacheAwareFilter",
                "SecurityContextHolderAwareRequestFilter",
                "AnonymousAuthenticationFilter",
                "ExceptionTranslationFilter",
                "AuthorizationFilter"
            ]
        }
    ]
}

# CorsConfigurationSource beans in the context.
$ curl -s localhost:8080/diag/cors-sources
{
    "corsConfigurationSourceBeans": {
        "mvcHandlerMappingIntrospector": "HandlerMappingIntrospector"
    },
    "hasBeanNamedCorsConfigurationSource": false
}

$ curl -s -i -X OPTIONS http://localhost:8080/api/data \
    -H 'Origin: https://spa.example.com' \
    -H 'Access-Control-Request-Method: POST' \
    -H 'Access-Control-Request-Headers: content-type,x-xsrf-token'

HTTP/1.1 401 
Set-Cookie: JSESSIONID=<session>; Path=/; HttpOnly; SameSite=Lax
WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY

# The MVC CORS mapping is real - it just never runs, because the request is
# rejected at AuthorizationFilter (order 4200) and the DispatcherServlet is
# downstream of the entire filter chain.