title: Spring MVC OPTIONS
body: <p>I have a spring-boot 1.3.0-BUILD-SNAPSHOT w/SpringSecurity project and I am concerned about security of the REST endpoints.  I have a CORS Filter defined:</p>
  
  <pre><code>@Configuration
  public class CorsConfiguration {
  
      @Bean
      public WebMvcConfigurer corsConfigurer() {
  
          return new WebMvcConfigurerAdapter() {
  
              @Override
              public void addCorsMappings(CorsRegistry registry) {
  
                  registry.addMapping( "/**" ).allowedOrigins( "*" )
                          .allowedHeaders( "Access-Control-Allow-Origin", "*"          )       "x-requested-with" )
                          .allowedHeaders("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE")
                          .allowedMethods("GET", "POST", "PUT", "DELETE")
                          .allowedMethods("Access-Control-Allow-Headers", "Content-Type")
                          .maxAge( 3600);
  
              }
  
          };
      }
  }
  </code></pre>
  
  <p>And I have a REST Controller:</p>
  
  <pre><code>@Controller
  @Transactional
  public class Controller extends BaseController {
  
      @Autowired
      private QuestionService questionService;
  
      @RequestMapping(value = "/questions", method = RequestMethod.GET)
      @ResponseBody
      public List&lt;Question&gt; getAllQuestions() {
          return questionService.getAllAvailableQuestions();
      }
  
    ...
  }
  </code></pre>
  
  <p>But when I hit one of the endpoints with an OPTIONS call I get a result that appears to allow more than just the GET this endpoint defines:</p>
  
  <pre><code>Allow → GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
  Cache-Control → no-cache, no-store, max-age=0, must-revalidate
  Content-Length → 0
  Date → Wed, 28 Oct 2015 16:32:12 GMT
  Expires → 0
  Pragma → no-cache
  Server → Apache-Coyote/1.1
  X-CSRF-HEADER → X-CSRF-TOKEN
  X-CSRF-PARAM → _csrf
  X-CSRF-TOKEN → 83983056-f904-449e-a215-fe9f9492866b
  X-Content-Type-Options → nosniff
  X-Frame-Options → DENY
  X-XSS-Protection → 1; mode=block
  </code></pre>
  
  <p>I thought Spring MVC would ignore OPTIONS call by default.  But I guess I also don't understand why I am seeing <code>Allow → GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH</code> being returned when I only allow GET for that call.  In the entire application I only allow GET, PUT, POST, DELETE so I don't know why the other values are returned, and what that means.  And most importantly, is this a security vulnerability?</p>