org.springframework.web.cors

Class CorsConfiguration

java.lang.Object

org.springframework.web.cors.CorsConfiguration

public class CorsConfiguration
extends java.lang.Object

A container for CORS configuration that also provides methods to check the actual or requested origin, HTTP methods, and headers.

Since:

4.2

Author:

Sebastien Deleuze, Rossen Stoyanchev, Juergen Hoeller, Sam Brannen

See Also:

CORS W3C recommendation

Field Summary

Fields

Modifier and Type	Field and Description
static java.lang.String	ALL Wildcard representing all origins, methods, or headers.
private java.lang.Boolean	allowCredentials
private java.util.List<java.lang.String>	allowedHeaders
private java.util.List<java.lang.String>	allowedMethods
private java.util.List<java.lang.String>	allowedOrigins
private static java.util.List<HttpMethod>	DEFAULT_METHODS
private java.util.List<java.lang.String>	exposedHeaders
private java.lang.Long	maxAge
private java.util.List<HttpMethod>	resolvedMethods

Constructor Summary

Constructors

Constructor and Description
CorsConfiguration() Construct a new, empty CorsConfiguration instance.
CorsConfiguration(CorsConfiguration other) Construct a new CorsConfiguration instance by copying all values from the supplied CorsConfiguration.

Method Summary

Modifier and Type	Method and Description
void	addAllowedHeader(java.lang.String allowedHeader) Add an actual request header to allow.
void	addAllowedMethod(HttpMethod method) Add an HTTP method to allow.
void	addAllowedMethod(java.lang.String method) Add an HTTP method to allow.
void	addAllowedOrigin(java.lang.String origin) Add an origin to allow.
void	addExposedHeader(java.lang.String exposedHeader) Add a response header to expose.
java.util.List<java.lang.String>	checkHeaders(java.util.List<java.lang.String> requestHeaders) Check the supplied request headers (or the headers listed in the Access-Control-Request-Headers of a pre-flight request) against the configured allowed headers.
java.util.List<HttpMethod>	checkHttpMethod(HttpMethod requestMethod) Check the HTTP request method (or the method from the Access-Control-Request-Method header on a pre-flight request) against the configured allowed methods.
java.lang.String	checkOrigin(java.lang.String requestOrigin) Check the origin of the request against the configured allowed origins.
CorsConfiguration	combine(CorsConfiguration other) Combine the supplied CorsConfiguration with this one.
private java.util.List<java.lang.String>	combine(java.util.List<java.lang.String> source, java.util.List<java.lang.String> other)
java.lang.Boolean	getAllowCredentials() Return the configured allowCredentials flag, possibly null.
java.util.List<java.lang.String>	getAllowedHeaders() Return the allowed actual request headers, possibly null.
java.util.List<java.lang.String>	getAllowedMethods() Return the allowed HTTP methods, possibly null in which case only "GET" and "HEAD" allowed.
java.util.List<java.lang.String>	getAllowedOrigins() Return the configured origins to allow, possibly null.
java.util.List<java.lang.String>	getExposedHeaders() Return the configured response headers to expose, possibly null.
java.lang.Long	getMaxAge() Return the configured maxAge value, possibly null.
void	setAllowCredentials(java.lang.Boolean allowCredentials) Whether user credentials are supported.
void	setAllowedHeaders(java.util.List<java.lang.String> allowedHeaders) Set the list of headers that a pre-flight request can list as allowed for use during an actual request.
void	setAllowedMethods(java.util.List<java.lang.String> allowedMethods) Set the HTTP methods to allow, e.g.
void	setAllowedOrigins(java.util.List<java.lang.String> allowedOrigins) Set the origins to allow, e.g.
void	setExposedHeaders(java.util.List<java.lang.String> exposedHeaders) Set the list of response headers other than simple headers (i.e.
void	setMaxAge(java.lang.Long maxAge) Configure how long, in seconds, the response from a pre-flight request can be cached by clients.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ALL

public static final java.lang.String ALL

Wildcard representing all origins, methods, or headers.

See Also:

Constant Field Values

DEFAULT_METHODS

private static final java.util.List<HttpMethod> DEFAULT_METHODS

allowedOrigins

private java.util.List<java.lang.String> allowedOrigins

allowedMethods

private java.util.List<java.lang.String> allowedMethods

resolvedMethods

private java.util.List<HttpMethod> resolvedMethods

allowedHeaders

private java.util.List<java.lang.String> allowedHeaders

exposedHeaders

private java.util.List<java.lang.String> exposedHeaders

allowCredentials

private java.lang.Boolean allowCredentials

maxAge

private java.lang.Long maxAge

Constructor Detail

CorsConfiguration

public CorsConfiguration()

Construct a new, empty CorsConfiguration instance.

CorsConfiguration

public CorsConfiguration(CorsConfiguration other)

Construct a new CorsConfiguration instance by copying all values from the supplied CorsConfiguration.

Method Detail

combine

public CorsConfiguration combine(CorsConfiguration other)

Combine the supplied CorsConfiguration with this one.

Properties of this configuration are overridden by any non-null properties of the supplied one.

Returns:

the combined CorsConfiguration or this configuration if the supplied configuration is null

combine

private java.util.List<java.lang.String> combine(java.util.List<java.lang.String> source,
                                                 java.util.List<java.lang.String> other)

setAllowedOrigins

public void setAllowedOrigins(java.util.List<java.lang.String> allowedOrigins)

Set the origins to allow, e.g. "http://domain1.com".

The special value "*" allows all domains.

By default this is not set.

getAllowedOrigins

public java.util.List<java.lang.String> getAllowedOrigins()

Return the configured origins to allow, possibly null.

See Also:

addAllowedOrigin(String), setAllowedOrigins(List)

addAllowedOrigin

public void addAllowedOrigin(java.lang.String origin)

Add an origin to allow.

setAllowedMethods

public void setAllowedMethods(java.util.List<java.lang.String> allowedMethods)

Set the HTTP methods to allow, e.g. "GET", "POST", "PUT", etc.

The special value "*" allows all methods.

If not set, only "GET" and "HEAD" are allowed.

By default this is not set.

getAllowedMethods

public java.util.List<java.lang.String> getAllowedMethods()

Return the allowed HTTP methods, possibly null in which case only "GET" and "HEAD" allowed.

See Also:

addAllowedMethod(HttpMethod), addAllowedMethod(String), setAllowedMethods(List)

addAllowedMethod

public void addAllowedMethod(HttpMethod method)

Add an HTTP method to allow.

addAllowedMethod

public void addAllowedMethod(java.lang.String method)

Add an HTTP method to allow.

setAllowedHeaders

public void setAllowedHeaders(java.util.List<java.lang.String> allowedHeaders)

Set the list of headers that a pre-flight request can list as allowed for use during an actual request.

The special value "*" allows actual requests to send any header.

A header name is not required to be listed if it is one of: Cache-Control, Content-Language, Expires, Last-Modified, or Pragma.

By default this is not set.

getAllowedHeaders

public java.util.List<java.lang.String> getAllowedHeaders()

Return the allowed actual request headers, possibly null.

See Also:

addAllowedHeader(String), setAllowedHeaders(List)

addAllowedHeader

public void addAllowedHeader(java.lang.String allowedHeader)

Add an actual request header to allow.

setExposedHeaders

public void setExposedHeaders(java.util.List<java.lang.String> exposedHeaders)

Set the list of response headers other than simple headers (i.e. Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, or Pragma) that an actual response might have and can be exposed.

Note that "*" is not a valid exposed header value.

By default this is not set.

getExposedHeaders

public java.util.List<java.lang.String> getExposedHeaders()

Return the configured response headers to expose, possibly null.

See Also:

addExposedHeader(String), setExposedHeaders(List)

addExposedHeader

public void addExposedHeader(java.lang.String exposedHeader)

Add a response header to expose.

Note that "*" is not a valid exposed header value.

setAllowCredentials

public void setAllowCredentials(java.lang.Boolean allowCredentials)

Whether user credentials are supported.

By default this is not set (i.e. user credentials are not supported).

getAllowCredentials

public java.lang.Boolean getAllowCredentials()

Return the configured allowCredentials flag, possibly null.

See Also:

setAllowCredentials(Boolean)

setMaxAge

public void setMaxAge(java.lang.Long maxAge)

Configure how long, in seconds, the response from a pre-flight request can be cached by clients.

By default this is not set.

getMaxAge

public java.lang.Long getMaxAge()

Return the configured maxAge value, possibly null.

See Also:

setMaxAge(Long)

checkOrigin

public java.lang.String checkOrigin(java.lang.String requestOrigin)

Check the origin of the request against the configured allowed origins.

Parameters:

requestOrigin - the origin to check

Returns:

the origin to use for the response, possibly null which means the request origin is not allowed

checkHttpMethod

public java.util.List<HttpMethod> checkHttpMethod(HttpMethod requestMethod)

Check the HTTP request method (or the method from the Access-Control-Request-Method header on a pre-flight request) against the configured allowed methods.

Parameters:

requestMethod - the HTTP request method to check

Returns:

the list of HTTP methods to list in the response of a pre-flight request, or null if the supplied requestMethod is not allowed

checkHeaders

public java.util.List<java.lang.String> checkHeaders(java.util.List<java.lang.String> requestHeaders)

Check the supplied request headers (or the headers listed in the Access-Control-Request-Headers of a pre-flight request) against the configured allowed headers.

Parameters:

requestHeaders - the request headers to check

Returns:

the list of allowed headers to list in the response of a pre-flight request, or null if none of the supplied request headers is allowed