title: How test CORS in Spring Boot? When I try in MockMvcBuilders, it always returns 200 despite Origin being wrong
body: <p>The below tests (I included two classes to see if either one would work) both have no issues calling the controller. I want it to reject with a CORS issue as I have not added any CORS config. (I then want to test with a CORS config and have that pass).</p>
  
  <p>How can I force a CORS failure?</p>
  
  <p>First Attempt:</p>
  
  <pre><code>import com.testing.Application;
  import com.testing.config.ControllerConfig;
  import com.testing.controller.MyController;
  import com.testing.dto.TestDateResponse;
  import com.testing.exception.GlobalExceptionHandler;
  import com.testing.service.TestService;
  import com.fasterxml.jackson.databind.ObjectMapper;
  import org.junit.Before;
  import org.junit.Test;
  import org.junit.runner.RunWith;
  import org.mockito.InjectMocks;
  import org.mockito.MockitoAnnotations;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.boot.test.context.SpringBootTest;
  import org.springframework.http.MediaType;
  import org.springframework.test.context.ContextConfiguration;
  import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
  import org.springframework.test.context.web.WebAppConfiguration;
  import org.springframework.test.web.servlet.MockMvc;
  import org.springframework.test.web.servlet.ResultActions;
  import org.springframework.test.web.servlet.setup.MockMvcBuilders;
  import org.springframework.web.client.RestTemplate;
  import org.springframework.web.context.ConfigurableWebApplicationContext;
  
  import java.time.LocalDate;
  
  import static org.hamcrest.Matchers.equalTo;
  import static org.hamcrest.Matchers.notNullValue;
  import static org.junit.Assert.assertThat;
  import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
  import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
  import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
  
  @RunWith(SpringJUnit4ClassRunner.class)
  @SpringBootTest(classes = Application.class)
  @WebAppConfiguration
  public class TestCORS
  {
      @Autowired
      private ConfigurableWebApplicationContext context;
  
      private MockMvc mockMvc;
      private ObjectMapper objectMapper;
  
      @InjectMocks
      private MyController myController;
  
      @Autowired
      private RestTemplate restTemplate;
  
      @Before
      public void setup()
      {
          //Initialize our injected mocks
          MockitoAnnotations.initMocks(this);
  
          //Create a controller
          myController = new MyController( new TestService(), restTemplate );
  
          //Create an environment for it
          mockMvc = MockMvcBuilders
              .webAppContextSetup(context)
              .dispatchOptions(true)
              .build();
  
          //Create our marshaller
          objectMapper = new ObjectMapper();
      }
  
      /**
       * Tests that we fail when trying to access cross origin
       * @throws Exception if json unmarshaller cannot parse the response
       */
      @Test
      public void testValidRequest() throws Exception
      {
          String request = "{\"asOfDate\":\"20170210\"}";
  
          //Call to test a date
          ResultActions actions = mockMvc.perform(
              post("/v1/testdate")
                  .contentType(MediaType.APPLICATION_JSON)
                  .content(request)
  
                  //CORS HEADERS
                  .header("Access-Control-Request-Method", "DELETE")
                  .header("Origin", "https://evil.com")
          );
  
          actions.andExpect(status().isOk())
              .andExpect(content().contentType(MediaType.APPLICATION_JSON_UTF8));
  
          TestDateResponse response = objectMapper.readValue(actions.andReturn().getResponse().getContentAsString(), TestDateResponse.class);
          assertThat(response, notNullValue());
          // verify date has returned back correctly
          assertThat(response.getRetDate(), equalTo(LocalDate.of(2017, 02, 10)));
      }
  }
  </code></pre>
  
  <p>Second Attempt:</p>
  
  <pre><code>import com.testing.config.ControllerConfig;
  import com.testing.controller.MyController;
  import com.testing.dto.TestDateResponse;
  import com.testing.exception.GlobalExceptionHandler;
  import com.testing.service.TestService;
  import com.fasterxml.jackson.databind.ObjectMapper;
  import org.junit.Before;
  import org.junit.Test;
  import org.junit.runner.RunWith;
  import org.mockito.MockitoAnnotations;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.http.MediaType;
  import org.springframework.test.context.ContextConfiguration;
  import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
  import org.springframework.test.web.servlet.MockMvc;
  import org.springframework.test.web.servlet.ResultActions;
  import org.springframework.test.web.servlet.setup.MockMvcBuilders;
  import org.springframework.web.client.RestTemplate;
  
  import java.time.LocalDate;
  
  import static org.hamcrest.Matchers.equalTo;
  import static org.hamcrest.Matchers.notNullValue;
  import static org.junit.Assert.assertThat;
  import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
  import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
  import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
  
  @RunWith(SpringJUnit4ClassRunner.class)
  @ContextConfiguration(classes = {ControllerConfig.class})
  public class TestCORS
  {
      private MockMvc mockMvc;
      private ObjectMapper objectMapper;
      private MyController myController;
  
      @Autowired
      private RestTemplate restTemplate;
  
      @Before
      public void setup()
      {
          //Initialize our injected mocks
          MockitoAnnotations.initMocks(this);
  
          //Create a controller
          myController = new MyController( new TestService(), restTemplate );
  
          //Create an environment for it
          mockMvc = MockMvcBuilders.standaloneSetup(myController)
              .setControllerAdvice(new GlobalExceptionHandler())
              .build();
  
          //Create our marshaller
          objectMapper = new ObjectMapper();
      }
  
      /**
       * Tests that we fail when trying to access cross origin
       * @throws Exception if json unmarshaller cannot parse the response
       */
      @Test
      public void testValidRequest() throws Exception
      {
          String request = "{\"asOfDate\":\"20170210\"}";
  
          //Call to test a date
          ResultActions actions = mockMvc.perform(
              post("/v1/testdate")
                  .contentType(MediaType.APPLICATION_JSON)
                  .content(request)
  
                  //CORS HEADERS
                  .header("Access-Control-Request-Method", "GET")
                  .header("Origin", "http://www.someurl.com")
          );
          actions.andExpect(status().isOk())
              .andExpect(content().contentType(MediaType.APPLICATION_JSON_UTF8));
  
          TestDateResponse response = objectMapper.readValue(actions.andReturn().getResponse().getContentAsString(), TestDateResponse.class);
          assertThat(response, notNullValue());
          // verify date has returned back correctly
          assertThat(response.getRetDate(), equalTo(LocalDate.of(2017, 02, 10)));
      }
  }
  </code></pre>