title: Testing CORs in SpringBootTest
body: <p>Im trying to write a test to verify our CORS settings.  I configure CORS like this. </p>
  
  <pre><code>@Override
      public void configure(HttpSecurity httpSecurity) throws Exception {
  //        super.configure(httpSecurity);
          httpSecurity.csrf().disable();
          httpSecurity.authorizeRequests().antMatchers("/**").permitAll();
          httpSecurity.cors();
      }
  
      @Bean
      public CorsConfigurationSource corsConfigurationSource() {
          CorsConfiguration configuration = new CorsConfiguration();
          List&lt;String&gt; allowedMethods = CORS_ALLOWED_METHODS;
          configuration.setAllowedMethods(allowedMethods);
          configuration.setAllowedOrigins(CORS_ALLOWED_ORIGINS);
          configuration.setAllowedHeaders(CORS_ALLOWED_HEADERS);
          configuration.setAllowCredentials(true);
          UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          source.registerCorsConfiguration("/**", configuration);
          return source;
      }
  </code></pre>
  
  <p>I have verified with the debugger that <code>CORS_ALLOWED_METHODS</code> has values when my test runs.</p>
  
  <p>Here is my test.  It fails when I assert on the headers. </p>
  
  <pre><code>@RunWith(SpringRunner.class)
  @SpringBootTest
  @ActiveProfiles("dev")
  public class ControllerTests {
  
      @Autowired
      private WebApplicationContext wac;
  
      public MockMvc mockMvc;
  
      @Before
      public void setup() {
          DefaultMockMvcBuilder builder = MockMvcBuilders
                  .webAppContextSetup(this.wac)
                  .apply(SecurityMockMvcConfigurers.springSecurity())
                  .dispatchOptions(true);
          this.mockMvc = builder.build();
      }
  
      @Test
      public void testCors() throws Exception {
          this.mockMvc
                  .perform(get("/test-cors"))
                  .andDo(print())
                  .andExpect(status().isOk())
                  .andExpect(header().string("Access-Control-Allow-Methods", "OPTIONS,GET,HEAD,POST,PUT,DELETE,TRACE,CONNECT"))
                  .andExpect(content().string("whatever"));
      }
  
      @SpringBootApplication(scanBasePackages = {"the.packages"})
      @Controller
      static class TestApplication {
  
          public static void main(String[] args) throws Exception {
              SpringApplication.run(TestApplication.class, args);
          }
  
          @RequestMapping(value = {"test-cors"},  method = RequestMethod.GET)
          @ResponseStatus(HttpStatus.OK)
          public @ResponseBody String testCors() {
              return "whatever";
          }
      }
  }
  </code></pre>
  
  <p>As a note, when I actually run a SpringBoot app with this configuration we do get CORS headers. </p>
  
  <p>Any help appreciated.</p>