title: CORS allowed-origin restrictions aren’t causing the server to reject requests
body: <p>I am using Spring Boot v1.5.1, and it seems my restriction on CORS origin is not working.</p>
  
  <p>My application.properties file has the following line (<a href="https://docs.spring.io/spring-boot/docs/current/reference/html/common-application-properties.html" rel="nofollow noreferrer">ref1</a> <a href="http://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html" rel="nofollow noreferrer">ref2</a>).</p>
  
  <pre><code>endpoints.cors.allowed-origins=http://mydomain.io
  </code></pre>
  
  <p>My REST controller looks like the following.</p>
  
  <pre><code>@RestController
  @CrossOrigin
  @RequestMapping("/api/car")
  public class CarCtrl {
    @Autowired
    private CarService carService;
  
    @GetMapping
    public Car get() {
      return carService.getLatest();
    }
  }
  </code></pre>
  
  <p>However, when I open up a browser and type in <code>http://localhost:8080/api/car</code> I am still able to access the REST endpoint.</p>
  
  <p>I also tried to change my annotation as follows, but that does not work.</p>
  
  <pre><code>@CrossOrigin("${endpoints.cors.allowed-origins}")
  </code></pre>
  
  <p>Any ideas on what I'm doing wrong?</p>
  
  <p>Note that I am not using <code>WebMvcConfigurerAdapter</code> like this <a href="https://stackoverflow.com/questions/36163672/cors-issue-with-spring-boot">post</a>. Do I really need to extends this class to explicitly control origin? I figured that the <code>@CrossOrigin</code> annotation in addition to the properties file setting would be able to control the allowed origins (as opposed to having to do so programmatically).  </p>