title: Spring websocket message broker adding extra Access-Control-Allow-Origin header to respose
body: <p>I have an application that includes a Spring cloud gateway that sits in front of an app which (among other things) supports web socket connections (sockJS). The gateway does a simple url rewrite when it forwards to the app. The two are currently running Spring-Boot 2.0.5.RELEASE and Spring-Cloud Finchley.RELEASE. According to the source I pulled down, this should be using spring-websockets-5.0.9.</p>
  
  <p>When I try to upgrade to 2.1.2.RELEASE and Greenwich.RELEASE for Spring-Boot and Spring-Cloud respectively, my websocket connections start failing because an extra Access-Cloud-Allow-Origin is being injected into the response.</p>
  
  <p>My gateway has a simple CORS filter like this (the values are constants and not relevant):</p>
  
  <pre><code>@Bean
  public WebFilter corsFilter() {
      return (ServerWebExchange ctx, WebFilterChain chain) -&gt; {
          Mono&lt;Void&gt; result;
          ServerHttpRequest request = ctx.getRequest();
          if (CorsUtils.isCorsRequest(request)) {
              ServerHttpResponse response = ctx.getResponse();
              HttpHeaders headers = response.getHeaders();
              headers.add("Access-Control-Allow-Origin", ALLOWED_ORIGIN);
              headers.add("Access-Control-Allow-Methods", ALLOWED_METHODS);
              headers.add("Access-Control-Max-Age", MAX_AGE);
              headers.add("Access-Control-Allow-Headers",ALLOWED_HEADERS);
              if (request.getMethod() == HttpMethod.OPTIONS) {
                  response.setStatusCode(HttpStatus.OK);
                  result = Mono.empty();
              } else {
                  result = chain.filter(ctx);
              }
          } else {
              result = chain.filter(ctx);
          }
          return result;
      };
  }
  </code></pre>
  
  <p>And my web socket config on the downstream app is simply this:</p>
  
  <pre><code>@Configuration
  @EnableWebSocketMessageBroker
  public class WebSocketConfig implements WebSocketMessageBrokerConfigurer {
  
      @Override
      public void configureMessageBroker(MessageBrokerRegistry config) {
          config.enableSimpleBroker("/topic");
          config.setApplicationDestinationPrefixes("/app");
      }
  
      @Override
      public void registerStompEndpoints(StompEndpointRegistry registry) {
          registry.addEndpoint("/ws")
                  .setAllowedOrigins("*")
              .withSockJS();
      }
  }
  </code></pre>
  
  <p>If I comment out the <code>.setAllowedOrigins("*")</code> in the <code>registerStompEndpoints</code> method, I correctly get 403 access denied responses, and the response only has the Access-Control-Allow-Origin header as injected by the gateway. </p>
  
  <p>With the method in place as shown here, the websocket response completes as expected with a success response to the caller, but the response header contains both the access control header injected by the gateway <em>plus</em> another Access-Control-Allow-Origin header which is set to the value of the caller (in my case, <a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a> for the front-end application.) None of the other access control headers are duplicated.</p>
  
  <p><strong>How can I configure the Spring websocket message broker to not inject the Access-Control-Allow-Origin header?</strong> This was working, and still works if I roll back to 2.0.5/Finchley.</p>