From c362e7047e646f38f868e82fcf17d3c15b48ca96 Mon Sep 17 00:00:00 2001 From: lobo Date: Mon, 12 Oct 2026 09:25:49 +0200 Subject: [PATCH] test(cors): pin Access-Control-Max-Age 3600 on preflight Refs #47 --- .../auth_service/configuration/security/SessionFlowTest.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/test/java/auth_service/configuration/security/SessionFlowTest.java b/src/test/java/auth_service/configuration/security/SessionFlowTest.java index 8b22562..6cbf9cc 100644 --- a/src/test/java/auth_service/configuration/security/SessionFlowTest.java +++ b/src/test/java/auth_service/configuration/security/SessionFlowTest.java @@ -298,7 +298,8 @@ class SessionFlowTest extends AbstractIntegrationTest { .header("Access-Control-Request-Headers", "x-tbp-client")) .andExpect(status().isOk()) .andExpect(header().string("Access-Control-Allow-Origin", FRONTEND)) - .andExpect(header().string("Access-Control-Allow-Credentials", "true")); + .andExpect(header().string("Access-Control-Allow-Credentials", "true")) + .andExpect(header().string("Access-Control-Max-Age", "3600")); mockMvc.perform(options("/api/auth/refresh") .header("Origin", "https://evil.andreas-dahm.eu")