Use LinkedHashMap for CORS configurations in CorsGatewayFilterApplicationListener to preserve insertion order. Fixes GH-3805.

Signed-off-by: Yavor Chamov <[email protected]>

Author: yavor300

spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/cors/CorsGatewayFilterApplicationListener.java

@@ -64,16 +64,17 @@ public CorsGatewayFilterApplicationListener(GlobalCorsProperties globalCorsPrope
 	public void onApplicationEvent(RefreshRoutesResultEvent event) {
 		routeLocator.getRoutes().collectList().subscribe(routes -> {
 			// pre-populate with pre-existing global cors configurations to combine with.
-			var corsConfigurations = new LinkedHashMap<>(globalCorsProperties.getCorsConfigurations());
+			Map<String, CorsConfiguration> corsConfigurations = new LinkedHashMap<>();
 
 			routes.forEach(route -> {
-				var corsConfiguration = getCorsConfiguration(route);
+				Optional<CorsConfiguration> corsConfiguration = getCorsConfiguration(route);
 				corsConfiguration.ifPresent(configuration -> {
 					var pathPredicate = getPathPredicate(route);
 					corsConfigurations.put(pathPredicate, configuration);
 				});
 			});
 
+			corsConfigurations.putAll(globalCorsProperties.getCorsConfigurations());
 			routePredicateHandlerMapping.setCorsConfigurations(corsConfigurations);
 		});
 	}

spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/filter/cors/CorsGatewayFilterApplicationListenerTests.java

@@ -46,8 +46,8 @@
 /**
  * Tests for {@link CorsGatewayFilterApplicationListener}.
  *
- * <p>This test verifies that the merged CORS configurations composed of global and
- * per-route metadata maintain insertion order as defined by the use of {@link LinkedHashMap}.
+ * <p>This test verifies that the merged CORS configurations - composed of per-route metadata
+ * and at the global level - maintain insertion order, as defined by the use of {@link LinkedHashMap}.
  * Preserving insertion order helps for predictable and deterministic CORS behavior
  * when resolving multiple matching path patterns.
  * </p>
@@ -56,8 +56,8 @@
  * that the resulting configuration map passed to {@link RoutePredicateHandlerMapping#setCorsConfigurations(Map)}
  * respects the declared order of:
  * <ul>
- *   <li>Global CORS configurations (in insertion order)</li>
  *   <li>Route-specific CORS configurations (in the order the routes are discovered)</li>
+ *   <li>Global CORS configurations (in insertion order)</li>
  * </ul>
  * </p>
  *
@@ -118,8 +118,8 @@ void testOnApplicationEvent_preservesInsertionOrder_withRealRoutes() {
 			verify(handlerMapping).setCorsConfigurations(corsConfigurations.capture());
 
 			Map<String, CorsConfiguration> mergedCorsConfigurations = corsConfigurations.getValue();
-			assertThat(mergedCorsConfigurations.keySet()).containsExactly(GLOBAL_PATH_1,
-					GLOBAL_PATH_2, ROUTE_PATH_1, ROUTE_PATH_2);
+			assertThat(mergedCorsConfigurations.keySet())
+					.containsExactly(ROUTE_PATH_1, ROUTE_PATH_2, GLOBAL_PATH_1, GLOBAL_PATH_2);
 			assertThat(mergedCorsConfigurations.get(GLOBAL_PATH_1).getAllowedOrigins())
 					.containsExactly(ORIGIN_GLOBAL_1);
 			assertThat(mergedCorsConfigurations.get(GLOBAL_PATH_2).getAllowedOrigins())