Juergen Hoeller opened SPR-13761 and commented
AbstractSockJsService and OriginHandshakeInterceptor both had setAllowedOrigins / getAllowedOrigins accessors added in the middle of the 4.1.x line, but unfortunately in an inefficient and inconsistent way: Since all access goes via contains calls, the optimal data structure is a Set. OriginHandshakeInterceptor fortunately already allows for adapting this since it declares Collection; however, for no good reason, AbstractSockJsService declares List instead. Aligning this towards consistent Collection declaration and efficient use of internal LinkedHashSets is necessary, and let's rather do this right now - also in 4.1.9 - before those methods get used on a more widespread basis. For declarative configuration and Java source compilation, this change is compatible anyway; it is just not binary-compatible for precompiled jars.
Affects: 4.1.8, 4.2.3
Issue Links:
Referenced from: commits 3d1ae9c, 83c9ec4
Backported to: 4.1.9