My company's HR sends out a document every time they schedule an interview explaining what can and can not be asked about. For example, you can ask "are you able to legally work in this country?" but not "what country are you from?"
A small firm that doesn't have this type of guidance is just asking for trouble.
As I said law is law, reality is reality.
Laws are powerful to those who would like to obey it, but not all of people, who clearly know the consequences but still break laws. Or why are there crimes that happened every day, if not every day but it should be almost every day.
Laws can punish people who break it, but not every one get punished.
Without evidences, proofs, money, I doubt that boss is asking for trouble. I am sure the OP didn't record it or is without any evidences. And she/he might not have money, or wouldn't like to spend money, time to hire a lawyer to file a lawsuit as she/he just is looking for the first ever job.
An American customer whom we have been working with for quite a long time, is trying to break the contract with my plant in China, but we cannot sue him, because the total amount is just $6000, it will cost us more to file a lawsuit against him, air tickets, lawyer fee, accommendation, visa, time, energy, evidences collecting, etc. What we pay would definitely be way more than just $ 6000.
I would conduct something which seems more practical to me, if the loss is not too much. I don't look for 100% fair things in this world.
Excuse me, I would like to call it a day for myself for this thread.