RepositoryRestHandlerMapping does not consider allowedOriginPatterns of @CrossOrigin

[dnlhpp]

When applying @CrossOrigin with allowedOriginPatterns set, these patterns are not transferred to the CorsConfiguration that the RepositoryRestHandlerMapping considers.

When not setting allowedOrigins, the default values are applied and "*" is set in allowedOrigins or the configuration object. When using this in conjunction with allowedCredentials = "true" an error is returned:

When allowCredentials is true, allowedOrigins cannot contain the special value "*" since that cannot be set on the "Access-Control-Allow-Origin" response header. To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead.

This cannot be fixed by modifying the annotation as the allowedOriginPatterns attribute is not considered by the following function.

The culprit seems to be in updateCorsConfig of RepositoryRestHandlerMapping.java as it does not add the allowedOriginPatterns of the @CrossOrigin annotation to the CorsConfiguration.

Is this intended? Otherwise I would create a pull request to fix this issue.

Best Regards,
Daniel