CorsRegistration corsRegistration = registry.addMapping("/**")
                .allowCredentials(true);
corsRegistration.allowedHeaders("*")
                .maxAge(1800L)
                .allowedMethods(HttpMethod.GET.name(),
                        HttpMethod.POST.name(),
                        HttpMethod.PUT.name(),
                        HttpMethod.OPTIONS.name(),
                        HttpMethod.DELETE.name())
                .exposedHeaders("Content-Length");

@RequestMapping("/test)
@RestController
public class ExampleController {
    @GetMapping
    public CompletableFuture<T> test() {
        // do something
    }
}

Vary | Origin
Vary | Access-Control-Request-Method
Vary | Access-Control-Request-Headers
Vary | Origin
Vary | Access-Control-Request-Method
Vary | Access-Control-Request-Headers