polish

Improve documentation of cors settings.

See gh-2936

spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/MvcEndpointCorsProperties.java

@@ -33,27 +33,30 @@ import org.springframework.web.cors.CorsConfiguration;
 public class MvcEndpointCorsProperties {
 
 	/**
-	 * List of origins to allow.
+	 * Comma-separated list of origins to allow. '*' allows all origins. When
+	 * not set, CORS support is disabled.
 	 */
 	private List<String> allowedOrigins = new ArrayList<String>();
 
 	/**
-	 * List of methods to allow.
+	 * Comma-separated list of methods to allow. '*' allows all methods. When
+	 * not set, defaults to GET.
 	 */
 	private List<String> allowedMethods = new ArrayList<String>();
 
 	/**
-	 * List of headers to allow in a request
+	 * Comma-separated list of headers to allow in a request. '*' allows all
+	 * headers.
 	 */
 	private List<String> allowedHeaders = new ArrayList<String>();
 
 	/**
-	 * List of headers to include in a response.
+	 * Comma-separated list of headers to include in a response.
 	 */
 	private List<String> exposedHeaders = new ArrayList<String>();
 
 	/**
-	 * Whether credentials are supported
+	 * Set whether credentials are supported. When not set, credentials are not supported.
 	 */
 	private Boolean allowCredentials;
 

spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc

@@ -552,7 +552,7 @@ content into your application; rather pick only the properties that you need.
 	endpoints.trace.enabled=true
 
 	# ENDPOINTS CORS CONFIGURATION ({sc-spring-boot-actuator}/autoconfigure/MvcEndpointCorsProperties.{sc-ext}[MvcEndpointCorsProperties])
-	endpoints.cors.allow-credentials= # whether user credentials are support. When not set, credentials are not supported.
+	endpoints.cors.allow-credentials= # set whether user credentials are support. When not set, credentials are not supported.
 	endpoints.cors.allowed-origins= # comma-separated list of origins to allow. * allows all origins. When not set, CORS support is disabled.
 	endpoints.cors.allowed-methods= # comma-separated list of methods to allow. * allows all methods. When not set, defaults to GET.
 	endpoints.cors.allowed-headers= # comma-separated list of headers to allow in a request. * allows all headers.