1 files changed, 14 insertions, 0 deletions
diff --git a/spec/requests/oauth/tokens_controller_spec.rb b/spec/requests/oauth/tokens_controller_spec.rb
new file mode 100644
index 00000000000..c3cdae2cd21
--- /dev/null
+++ b/spec/requests/oauth/tokens_controller_spec.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Oauth::TokensController do
+  it 'allows cross-origin POST requests' do
+    post '/oauth/token', headers: { 'Origin' => 'http://notgitlab.com' }
+
+    expect(response.headers['Access-Control-Allow-Origin']).to eq '*'
+    expect(response.headers['Access-Control-Allow-Methods']).to eq 'POST'
+    expect(response.headers['Access-Control-Allow-Headers']).to be_nil
+    expect(response.headers['Access-Control-Allow-Credentials']).to be_nil
+  end
+end