Remove duplicate CorsFilter bean causing double Access-Control-Allow-Origin header

Shipped

April 25, 2026 at 10:39 PM UTC

Author

Kamo

Commit

bf57a38

The explicit CorsFilter bean caused a second CORS filter alongside Spring Security's built-in CORS support (which uses CorsConfigurationSource). Both filters resolved the origin pattern and wrote the same header, producing the duplicate 'https://www.kamocrm.com, https://www.kamocrm.com' value that browsers reject. Removing the bean leaves CorsConfigurationSource in place for Spring Security and eliminates the duplicate.