The javadoc for HttpSecurity.cors(Customizer<CorsConfigurer<HttpSecurity>>) gives the impression that CORS is opt-in. Since the changes made for #5011 and #15444 that's no longer the case with a single UrlBasedCorsConfigurationSource bean now being sufficient to enable CORS without using the cors portion of the security configuration DSL.
The javadoc for
HttpSecurity.cors(Customizer<CorsConfigurer<HttpSecurity>>)gives the impression that CORS is opt-in. Since the changes made for #5011 and #15444 that's no longer the case with a singleUrlBasedCorsConfigurationSourcebean now being sufficient to enable CORS without using thecorsportion of the security configuration DSL.