diff --git a/src/test/java/auth_service/configuration/security/SessionFlowTest.java b/src/test/java/auth_service/configuration/security/SessionFlowTest.java
index 8b22562..6cbf9cc 100644
--- a/src/test/java/auth_service/configuration/security/SessionFlowTest.java
+++ b/src/test/java/auth_service/configuration/security/SessionFlowTest.java
@@ -298,7 +298,8 @@ class SessionFlowTest extends AbstractIntegrationTest {
                         .header("Access-Control-Request-Headers", "x-tbp-client"))
                 .andExpect(status().isOk())
                 .andExpect(header().string("Access-Control-Allow-Origin", FRONTEND))
-                .andExpect(header().string("Access-Control-Allow-Credentials", "true"));
+                .andExpect(header().string("Access-Control-Allow-Credentials", "true"))
+                .andExpect(header().string("Access-Control-Max-Age", "3600"));
 
         mockMvc.perform(options("/api/auth/refresh")
                         .header("Origin", "https://evil.andreas-dahm.eu")