Unable to configure CORS for multiple mappings

[leadtrip]

Expected Behavior

Adding cors mappings with lists of allowedOrigins to application.yml should result in these mappings being applied when making relevant cors requests.

Actual Behaviour

The mappings aren't applied and access is open to all.

Steps To Reproduce

In development environment.

With this config

grails:
    cors:
        enabled: true
        allowedHeaders:
            - Content-Type
        mappings:
            '[/word/googleOnly]':
                allowedOrigins:
                    - https://www.google.com
            '[/word/stackoverflowOnly]':
                allowedOrigins:
                    - https://stackoverflow.com
            '[/word/anywhere]':
                allowedOrigins:
                    - '*'

Make a fetch request to /word/googleOnly in the linked app from a browser's developer console e.g.

fetch("http://localhost:10005/word/googleOnly").then(a => a.text()).then(console.log)

This should only be possible from https://www.google.com but it's possible from any domain e.g.

The attached screenshot of a debugging session in GrailsCorsConfiguration highlights the issue where the code is expecting an allowedOrigins key but, depending on how many keys there are they are named allowedOrigins[0] and so on.

Environment Information

Windows 10 & 11
Open JDK 8
Grails 5.2.4

Example Application

https://github.com/leadtrip/g524cors

Version

5.2.4

[puneetbehl]

I think this is the result of something which has changed with Spring Boot, see spring-projects/spring-boot#6180

The solution would be to fix the class to use the type Map<Sting, List<Sting>> instead of Map<String, Object> where in the latter a list is converted to a hash map.

A workaround is to provide the configuration through the application.groovy file instead of YAML as:

grails {
    cors {
        enabled = true
        allowedHeaders = 'Content-Type'
        mappings {
            "/word/googleOnly" {
                allowedOrigins = ['https://www.google.com']
            }
            "/word/anywhere" {
                allowedOrigins = ['*']
            }
        }
    }
}