From 61865ce1bebd9520df0225eee4e86193466f9654 Mon Sep 17 00:00:00 2001 From: njp2k5 Date: Sat, 16 May 2026 18:13:29 +0530 Subject: [PATCH] Add test coverage for incomplete CORS preflight requests Signed-off-by: njp2k5 --- .../cloud/gateway/cors/CorsGlobalTests.java | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/spring-cloud-gateway-server-webflux/src/test/java/org/springframework/cloud/gateway/cors/CorsGlobalTests.java b/spring-cloud-gateway-server-webflux/src/test/java/org/springframework/cloud/gateway/cors/CorsGlobalTests.java index d4c85546c..5b66086eb 100644 --- a/spring-cloud-gateway-server-webflux/src/test/java/org/springframework/cloud/gateway/cors/CorsGlobalTests.java +++ b/spring-cloud-gateway-server-webflux/src/test/java/org/springframework/cloud/gateway/cors/CorsGlobalTests.java @@ -65,6 +65,18 @@ public void testPreFlightCorsRequest() { assertThat(clientResponse.statusCode()).as("Pre Flight call failed.").isEqualTo(HttpStatus.OK); } + @Test + public void testPreFlightCorsRequestWithoutAccessControlRequestMethod() { + ClientResponse clientResponse = webClient.options() + .uri("/abc/123/function") + .header("Origin", "domain.com") + .exchangeToMono(Mono::just) + .block(); + + assertThat(clientResponse).isNotNull(); + assertThat(clientResponse.statusCode()).isEqualTo(HttpStatus.FORBIDDEN); + } + @Test public void testCorsRequest() { ResponseEntity response = webClient.get()