Code review comment: @stuartwdouglas Sure, but returning `403` would be consistent with how we handle mismatched Origins for the preflights. This filter did return `200` for mismatched origins for preflight requests but then we changed it to `403` after some discussions which you may recall (incl for it to be consistent with Vert.x)   I see, if we block the method for an actual POST/etc request anyway, then, for the preflight request, it does not really matter if it is 403 or not, but if 403 can prevent some browsers even trying to follow up with an actual request then it should be good.   Can we agree on `403` in case of preflight method or header mis-matches ?

Code before review:
public void corsPreflightTest() {
String origin = "http:
String headers = "X-Custom";
given().header("Origin", origin)
.header("Access-Control-Request-Method", "GET")
.header("Access-Control-Request-Headers", headers)
.when()
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET, OPTIONS, POST")
.header("Access-Control-Allow-Headers", headers);
given().header("Origin", origin)
.header("Access-Control-Request-Method", "POST")
.header("Access-Control-Request-Headers", headers)
.when()
.auth().basic("test", "test")
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET, OPTIONS, POST")
.header("Access-Control-Allow-Headers", headers);
given().header("Origin", origin)
.header("Access-Control-Request-Method", "GET")
.header("Access-Control-Request-Headers", headers)
.when()
.auth().basic("test", "wrongpassword")
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET, OPTIONS, POST")
.header("Access-Control-Allow-Headers", headers);
given().header("Origin", origin)
.header("Access-Control-Request-Method", "POST")
.header("Access-Control-Request-Headers", headers)
.when()
.auth().basic("user", "user")
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET, OPTIONS, POST")
.header("Access-Control-Allow-Headers", headers);
given().header("Origin", origin)
.header("Access-Control-Request-Method", "PUT")
.header("Access-Control-Request-Headers", headers)
.when()
.auth().basic("user", "user")
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET, OPTIONS, POST")
.header("Access-Control-Allow-Headers", headers);
}

Line under review: .statusCode(200)

Code after addressing the review:
public void corsPreflightTest() {
String origin = "http:
String headers = "X-Custom";
given().header("Origin", origin)
.header("Access-Control-Request-Method", "GET")
.header("Access-Control-Request-Headers", headers)
.when()
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET,OPTIONS,POST")
.header("Access-Control-Allow-Headers", headers);
given().header("Origin", origin)
.header("Access-Control-Request-Method", "POST")
.header("Access-Control-Request-Headers", headers)
.when()
.auth().basic("test", "test")
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET,OPTIONS,POST")
.header("Access-Control-Allow-Headers", headers);
given().header("Origin", origin)
.header("Access-Control-Request-Method", "GET")
.header("Access-Control-Request-Headers", headers)
.when()
.auth().basic("test", "wrongpassword")
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET,OPTIONS,POST")
.header("Access-Control-Allow-Headers", headers);
given().header("Origin", origin)
.header("Access-Control-Request-Method", "POST")
.header("Access-Control-Request-Headers", headers)
.when()
.auth().basic("user", "user")
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET,OPTIONS,POST")
.header("Access-Control-Allow-Headers", headers);
given().header("Origin", origin)
.header("Access-Control-Request-Method", "PUT")
.header("Access-Control-Request-Headers", headers)
.when()
.auth().basic("user", "user")
.options("/test").then()
.statusCode(200)
.header("Access-Control-Allow-Origin", origin)
.header("Access-Control-Allow-Methods", "GET,OPTIONS,POST")
.header("Access-Control-Allow-Headers", headers);
}