First, I implemented a controller to handle OPTIONS requests and applied the headers needed for a CORS response. I recently cleaned up the code and created an interceptor for CORS material. Part of this cleanup would be the removal of controller methods for OPTIONS queries.
However, my mockmvc tests require OPTIONS processing methods to be there, and when I actually launch the application, the interceptor chain processes OPTIONS requests, even if there is no controller method for the OPTIONS request.
I would expect such a test
MockHttpServletRequestBuilder optionsRequest = options("the-url");
this.mockMvc.perform(optionsRequest).
andExpect(status().isOk()).
andExpect(header().string("Access-Control-Allow-Origin", "*")).
andExpect(header().string("Access-Control-Allow-Methods", "OPTIONS,GET,HEAD,POST,PUT,DELETE,TRACE,CONNECT")).
andExpect(header().string("Access-Control-Allow-Headers", "content-type"));
if my test setup has
StandaloneMockMvcBuilder builder = MockMvcBuilders.standaloneSetup(this.controller);
builder = builder.dispatchOptions(true);
builder = builder.addInterceptors(new CorsInterceptor());
either this, or I expect that I will not see cross-search requests working on a running application.