To test this, one can use the sample code from <https://spring.io/guides/gs/rest-service-cors/> with no changes.

Here's the output from an OPTIONS request without any CORS headers:

```sh
$ curl -X OPTIONS -i http://localhost:8080/greeting                                                                                                              HTTP/1.1 200 
Allow: GET,HEAD,OPTIONS
Content-Length: 0
Date: Wed, 24 Jul 2019 16:45:25 GMT

```

As expected, the `Allow` header is correct, as the method is annotated with `@GetMapping`.

But now let's simulate a CORS preflight OPTIONS request (which is not really necessary for a GET, but that's not the point), adding `Origin` and `Access-Control-Request-Method`:

```sh
$ curl -X OPTIONS -H'Origin: http://localhost:9000' -H'Access-Control-Request-Method: GET' -i http://localhost:8080/greeting
HTTP/1.1 200 
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Access-Control-Allow-Origin: http://localhost:9000
Access-Control-Allow-Methods: GET
Access-Control-Max-Age: 1800
Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
Content-Length: 0
Date: Wed, 24 Jul 2019 16:48:36 GMT

```

The CORS headers have been correctly included, but note that `Allow` now lists more methods than actually allowed (and which are indeed not allowed, with or without CORS; a 405 "Method not allowed" error is returned if one tries to POST to that URL).

Even more strange, `Access-Control-Allow-Methods` correctly lists only `GET`.

Am I misunderstanding some detail about how CORS should work, or is this a bug in Spring Boot?