.../Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php     | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php b/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
index 9e3de7d..b9c45db 100644
--- a/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
+++ b/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
@@ -33,8 +33,10 @@ public function testCrossSiteRequest() {
     $this->assertSame(FALSE, $cors_config['maxAge']);
     $this->assertSame(FALSE, $cors_config['supportsCredentials']);
 
-    // Enable CORS with the default options.
+    // Enable CORS with the default options, except allowed origins: only allow
+    // some origins so we can test with a disallowed origin.
     $cors_config['enabled'] = TRUE;
+    $cors_config['allowedOrigins'] = ['http://example.com', 'http://example.org'];
 
     $this->setContainerParameter('cors.config', $cors_config);
     $this->rebuildContainer();
@@ -64,6 +66,10 @@ public function testCrossSiteRequest() {
     $this->assertSession()->responseHeaderEquals('X-Drupal-Cache', 'HIT');
     $this->assertSession()->responseHeaderEquals('Access-Control-Allow-Origin', 'http://example.org');
 
+    // Fire a request for a different, non-allowed origin.
+    $this->drupalGet('/test-page', [], ['Origin' => 'http://evil.org']);
+    $this->assertSession()->statusCodeEquals(403);
+
     // Configure the CORS stack to allow a specific set of origins.
     $cors_config['allowedOrigins'] = ['http://example.com'];