部署至App Engine后Spring Security CORS配置失效求助

我在Spring Boot应用中通过Spring Security配置CORS规则，仅允许http://mywebsite.com和https://mywebsite.com这两个源的请求访问API。本地测试时该配置正常生效，但部署到Google App Engine后，API仍能被任意源访问，不符合预期。

Spring Security配置类 #

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {
    @Bean
    public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
        http.csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests(authorize -> authorize.anyRequest().permitAll())  // 允许所有请求
                .httpBasic(Customizer.withDefaults())
                .cors(httpSecurityCorsConfigurer -> httpSecurityCorsConfigurer.configurationSource(corsConfigurationSource()))
                .sessionManagement(sessionManagement -> sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
        return http.build();
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(List.of("http://mywebsite.com","https://mywebsite.com"));
        configuration.setAllowedHeaders(Arrays.asList("Access-Control-Allow-Origin", "Origin"));
        configuration.setAllowedMethods(Arrays.asList("GET","POST","DELETE","PUT"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

控制器代码 #

@RestController
@RequestMapping("/cars")
public class CarController {

    private final CarService carService;

    public CarController(CarService carService) {
        this.carService = carService;
    }

    @PostMapping(consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
    public Mono<Car> saveCar(@RequestBody Car car) {
        return carService.saveCar(car);
    }

    @DeleteMapping("/{carId}")
    public Mono<Void> deleteCar(@PathVariable String carId) {
        return carService.deleteCar(carId);
    }

    @GetMapping
    public Flux<Car> findAllCars() {
        return carService.findALlCars();
    }

    @GetMapping("/city/{city}")
    public Flux<Car> findCarsByCity(@PathVariable String city) {
        return carService.findCarsByCity(city);
    }
}

App Engine部署配置（app.yml） #

runtime: java17
instance_class: F1

我了解可以在app.yml中配置CORS，但更希望由Spring Security来处理跨域限制问题。

附加信息 #

请求头信息 #

测试请求的Origin为非允许源https://test-website.com，同时携带Access-Control-Request-Method: GET等CORS预检请求头。

响应头信息 #

API返回的响应头中包含Access-Control-Allow-Origin: *，表明CORS限制未生效。

内容的提问来源于stack exchange，提问作者mr.Penguin