[This check](https://github.com/spring-projects/spring-framework/blob/0e4e25d227dedd1a3ecddc4e40c263f190ca1c2b/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java#L337) is dated. Wildcard is a valid configuration according to [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers) and [spec](https://fetch.spec.whatwg.org/#http-new-header-syntax).