Avoid rejecting same origin requests detected as CORS requests [SPR-13206]

[spring-projects-issues]

Sébastien Deleuze opened SPR-13206 and commented

Browsers like Chrome or Safari include an Origin header on same-origin POST/PUT/DELETE requests. As a consequence, these requests are detected as potential CORS requests by CorsUtils.isCorsRequest() and wrongly rejected if a CorsConfiguration is defined with an allowedOrigins property that does not contain the same origin domain. This is an issue since most users will configure only the cross origin domains.

---

Affects: 4.2 RC2

Referenced from: commits 84138ab

[spring-projects-issues]

Sébastien Deleuze commented

Resolved by this commit.