CorsService always gives the Access-Control headers, also in 'production'

[hbogaards]

When running my Grails application with grails.env=production I still get the Access-Control headers.

This is caused by the CorsService.

It contains this code:

if( excludeEnvironments && excludeEnvironments.contains(Environment.current.name) )  { // current env is excluded
    // skip
    false
}
else if( includeEnvironments && !includeEnvironments.contains(Environment.current.name) )  {  // current env is not included
    // skip
    false
}

...

The false lines should be replaced with return false or the rest of the method should be encased in an else clause