1183 - Added PUT as a default allowed method in CORS (#1184)

Author: mrioan

extensions/servlet/src/main/resources/com/stormpath/sdk/servlet/config/web.stormpath.properties

@@ -355,4 +355,4 @@ stormpath.web.cors.enabled = true
 #Comma separated list of allowed origins
 stormpath.web.cors.allowed.originUris =
 stormpath.web.cors.allowed.headers = Content-Type,Accept,X-Requested-With,remember-me
-stormpath.web.cors.allowed.methods = POST,GET,OPTIONS,DELETE
+stormpath.web.cors.allowed.methods = POST,GET,OPTIONS,DELETE,PUT

extensions/spring/boot/stormpath-webmvc-spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json

@@ -1024,7 +1024,7 @@
       "name": "stormpath.web.cors.allowed.methods",
       "type": "java.lang.String",
       "description": "Comma separated list of allowed methods for a CORS request.",
-      "defaultValue": "POST,GET,OPTIONS,DELETE"
+      "defaultValue": "POST,GET,OPTIONS,DELETE,PUT"
     }
   ]
 }

extensions/spring/stormpath-spring-security-webmvc/src/test/groovy/com/stormpath/spring/config/CorsFilterIT.groovy

@@ -106,7 +106,7 @@ class CorsFilterIT extends AbstractTestNGSpringContextTests {
     void testAccessControlRequestMethodRequestFailsForPUT() {
         mvc.perform(options(new URI("/me"))
                     .header("Origin", "http://localhost:3000")
-                    .header("Access-Control-Request-Method", "PUT") //PUT is not allowed
+                    .header("Access-Control-Request-Method", "HEAD") //HEAD is not allowed
                     .accept(MediaType.APPLICATION_JSON))
                 .andExpect(status().is(HttpServletResponse.SC_FORBIDDEN)); //403
 

extensions/spring/stormpath-spring-webmvc/src/main/java/com/stormpath/spring/config/AbstractStormpathWebMvcConfiguration.java

@@ -407,7 +407,7 @@ public abstract class AbstractStormpathWebMvcConfiguration {
     @Value("#{ @environment['stormpath.web.cors.allowed.headers'] ?: 'Content-Type,Accept,X-Requested-With,remember-me' }")
     protected String corsAllowedHeaders;
 
-    @Value("#{ @environment['stormpath.web.cors.allowed.methods'] ?: 'POST,GET,OPTIONS,DELETE' }")
+    @Value("#{ @environment['stormpath.web.cors.allowed.methods'] ?: 'POST,GET,OPTIONS,DELETE,PUT' }")
     protected String corsAllowedMethods;
 
     @Autowired(required = false)