Fix allowCredentials property handling

Closes spring-projectsgh-3059
Eviradnus · May 28, 2015 · 8861239 · 8861239
1 parent fc067d1
commit 8861239
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/...c/main/java/org/springframework/boot/actuate/autoconfigure/MvcEndpointCorsProperties.java b/...c/main/java/org/springframework/boot/actuate/autoconfigure/MvcEndpointCorsProperties.java
@@ -133,7 +133,7 @@ CorsConfiguration toCorsConfiguration() {
 			corsConfiguration.setMaxAge(this.maxAge);
 		}
 		if (this.allowCredentials != null) {
-			corsConfiguration.setAllowCredentials(true);
+			corsConfiguration.setAllowCredentials(this.allowCredentials);
 		}
 		return corsConfiguration;
 	}

diff --git a/...t/java/org/springframework/boot/actuate/endpoint/mvc/MvcEndpointCorsIntegrationTests.java b/...t/java/org/springframework/boot/actuate/endpoint/mvc/MvcEndpointCorsIntegrationTests.java
@@ -160,6 +160,15 @@ public void credentialsCanBeAllowed() throws Exception {
 				header().string(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"));
 	}
 
+	@Test
+	public void credentialsCanBeDisabled() throws Exception {
+		EnvironmentTestUtils.addEnvironment(this.context,
+				"endpoints.cors.allowed-origins:foo.example.com",
+				"endpoints.cors.allow-credentials:false");
+		performAcceptedCorsRequest().andExpect(
+				header().doesNotExist(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS));
+	}
+
 	@Test
 	public void jolokiaEndpointUsesGlobalCorsConfiguration() throws Exception {
 		EnvironmentTestUtils.addEnvironment(this.context,