CorsRegistry implements combine correctly

Closes gh-26877

Author: rstoyanchev

spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -475,7 +475,6 @@ public void validateAllowCredentials() {
 	 * @return the combined {@code CorsConfiguration}, or {@code this}
 	 * configuration if the supplied configuration is {@code null}
 	 */
-	@Nullable
 	public CorsConfiguration combine(@Nullable CorsConfiguration other) {
 		if (other == null) {
 			return this;

spring-webflux/src/main/java/org/springframework/web/reactive/config/CorsRegistration.java

@@ -35,7 +35,7 @@ public class CorsRegistration {
 
 	private final String pathPattern;
 
-	private final CorsConfiguration config;
+	private CorsConfiguration config;
 
 
 	public CorsRegistration(String pathPattern) {
@@ -149,7 +149,7 @@ public CorsRegistration maxAge(long maxAge) {
 	 * @since 5.3
 	 */
 	public CorsRegistration combine(CorsConfiguration other) {
-		this.config.combine(other);
+		this.config = this.config.combine(other);
 		return this;
 	}
 

spring-webflux/src/test/java/org/springframework/web/reactive/config/CorsRegistryTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -73,4 +73,24 @@ public void allowCredentials() {
 				.containsExactly("*");
 	}
 
+	@Test
+	void combine() {
+		CorsConfiguration otherConfig = new CorsConfiguration();
+		otherConfig.addAllowedOrigin("http://localhost:3000");
+		otherConfig.addAllowedMethod("*");
+		otherConfig.applyPermitDefaultValues();
+
+		this.registry.addMapping("/api/**").combine(otherConfig);
+
+		Map<String, CorsConfiguration> configs = this.registry.getCorsConfigurations();
+		assertThat(configs.size()).isEqualTo(1);
+		CorsConfiguration config = configs.get("/api/**");
+		assertThat(config.getAllowedOrigins()).isEqualTo(Collections.singletonList("http://localhost:3000"));
+		assertThat(config.getAllowedMethods()).isEqualTo(Collections.singletonList("*"));
+		assertThat(config.getAllowedHeaders()).isEqualTo(Collections.singletonList("*"));
+		assertThat(config.getExposedHeaders()).isEmpty();
+		assertThat(config.getAllowCredentials()).isNull();
+		assertThat(config.getMaxAge()).isEqualTo(Long.valueOf(1800));
+	}
+
 }

spring-webmvc/src/main/java/org/springframework/web/servlet/config/annotation/CorsRegistration.java

@@ -36,7 +36,7 @@ public class CorsRegistration {
 
 	private final String pathPattern;
 
-	private final CorsConfiguration config;
+	private CorsConfiguration config;
 
 
 	public CorsRegistration(String pathPattern) {
@@ -150,7 +150,7 @@ public CorsRegistration maxAge(long maxAge) {
 	 * @since 5.3
 	 */
 	public CorsRegistration combine(CorsConfiguration other) {
-		this.config.combine(other);
+		this.config = this.config.combine(other);
 		return this;
 	}
 

spring-webmvc/src/test/java/org/springframework/web/servlet/config/annotation/CorsRegistryTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -77,4 +77,24 @@ public void allowCredentials() {
 				.as("Globally origins=\"*\" and allowCredentials=true should be possible")
 				.containsExactly("*");
 	}
+
+	@Test
+	void combine() {
+		CorsConfiguration otherConfig = new CorsConfiguration();
+		otherConfig.addAllowedOrigin("http://localhost:3000");
+		otherConfig.addAllowedMethod("*");
+		otherConfig.applyPermitDefaultValues();
+
+		this.registry.addMapping("/api/**").combine(otherConfig);
+
+		Map<String, CorsConfiguration> configs = this.registry.getCorsConfigurations();
+		assertThat(configs.size()).isEqualTo(1);
+		CorsConfiguration config = configs.get("/api/**");
+		assertThat(config.getAllowedOrigins()).isEqualTo(Collections.singletonList("http://localhost:3000"));
+		assertThat(config.getAllowedMethods()).isEqualTo(Collections.singletonList("*"));
+		assertThat(config.getAllowedHeaders()).isEqualTo(Collections.singletonList("*"));
+		assertThat(config.getExposedHeaders()).isEmpty();
+		assertThat(config.getAllowCredentials()).isNull();
+		assertThat(config.getMaxAge()).isEqualTo(Long.valueOf(1800));
+	}
 }