public class CorsConfiguration
extends java.lang.Object
By default a newly created CorsConfiguration
does not permit any
cross-origin requests and must be configured explicitly to indicate what
should be allowed. Use applyPermitDefaultValues()
to flip the
initialization model to start with open defaults that permit all cross-origin
requests for GET, HEAD, and POST requests.
Modifier and Type | Field and Description |
---|---|
static java.lang.String |
ALL
Wildcard representing all origins, methods, or headers.
|
private java.lang.Boolean |
allowCredentials |
private java.util.List<java.lang.String> |
allowedHeaders |
private java.util.List<java.lang.String> |
allowedMethods |
private java.util.List<java.lang.String> |
allowedOrigins |
private static java.util.List<HttpMethod> |
DEFAULT_METHODS |
private static java.util.List<java.lang.String> |
DEFAULT_PERMIT_ALL |
private static java.util.List<java.lang.String> |
DEFAULT_PERMIT_METHODS |
private java.util.List<java.lang.String> |
exposedHeaders |
private java.lang.Long |
maxAge |
private java.util.List<HttpMethod> |
resolvedMethods |
Constructor and Description |
---|
CorsConfiguration()
Construct a new
CorsConfiguration instance with no cross-origin
requests allowed for any origin by default. |
CorsConfiguration(CorsConfiguration other)
Construct a new
CorsConfiguration instance by copying all
values from the supplied CorsConfiguration . |
Modifier and Type | Method and Description |
---|---|
void |
addAllowedHeader(java.lang.String allowedHeader)
Add an actual request header to allow.
|
void |
addAllowedMethod(HttpMethod method)
Add an HTTP method to allow.
|
void |
addAllowedMethod(java.lang.String method)
Add an HTTP method to allow.
|
void |
addAllowedOrigin(java.lang.String origin)
Add an origin to allow.
|
void |
addExposedHeader(java.lang.String exposedHeader)
Add a response header to expose.
|
CorsConfiguration |
applyPermitDefaultValues()
By default a newly created
CorsConfiguration does not permit any
cross-origin requests and must be configured explicitly to indicate what
should be allowed. |
java.util.List<java.lang.String> |
checkHeaders(java.util.List<java.lang.String> requestHeaders)
Check the supplied request headers (or the headers listed in the
Access-Control-Request-Headers of a pre-flight request) against
the configured allowed headers. |
java.util.List<HttpMethod> |
checkHttpMethod(HttpMethod requestMethod)
Check the HTTP request method (or the method from the
Access-Control-Request-Method header on a pre-flight request)
against the configured allowed methods. |
java.lang.String |
checkOrigin(java.lang.String requestOrigin)
Check the origin of the request against the configured allowed origins.
|
CorsConfiguration |
combine(CorsConfiguration other)
Combine the non-null properties of the supplied
CorsConfiguration with this one. |
private java.util.List<java.lang.String> |
combine(java.util.List<java.lang.String> source,
java.util.List<java.lang.String> other) |
java.lang.Boolean |
getAllowCredentials()
Return the configured
allowCredentials flag, or null if none. |
java.util.List<java.lang.String> |
getAllowedHeaders()
Return the allowed actual request headers, or
null if none. |
java.util.List<java.lang.String> |
getAllowedMethods()
Return the allowed HTTP methods, or
null in which case
only "GET" and "HEAD" allowed. |
java.util.List<java.lang.String> |
getAllowedOrigins()
Return the configured origins to allow, or
null if none. |
java.util.List<java.lang.String> |
getExposedHeaders()
Return the configured response headers to expose, or
null if none. |
java.lang.Long |
getMaxAge()
Return the configured
maxAge value, or null if none. |
void |
setAllowCredentials(java.lang.Boolean allowCredentials)
Whether user credentials are supported.
|
void |
setAllowedHeaders(java.util.List<java.lang.String> allowedHeaders)
Set the list of headers that a pre-flight request can list as allowed
for use during an actual request.
|
void |
setAllowedMethods(java.util.List<java.lang.String> allowedMethods)
Set the HTTP methods to allow, e.g.
|
void |
setAllowedOrigins(java.util.List<java.lang.String> allowedOrigins)
Set the origins to allow, e.g.
|
void |
setExposedHeaders(java.util.List<java.lang.String> exposedHeaders)
Set the list of response headers other than simple headers (i.e.
|
void |
setMaxAge(java.lang.Long maxAge)
Configure how long, in seconds, the response from a pre-flight request
can be cached by clients.
|
public static final java.lang.String ALL
private static final java.util.List<HttpMethod> DEFAULT_METHODS
private static final java.util.List<java.lang.String> DEFAULT_PERMIT_ALL
private static final java.util.List<java.lang.String> DEFAULT_PERMIT_METHODS
@Nullable private java.util.List<java.lang.String> allowedOrigins
@Nullable private java.util.List<java.lang.String> allowedMethods
@Nullable private java.util.List<HttpMethod> resolvedMethods
@Nullable private java.util.List<java.lang.String> allowedHeaders
@Nullable private java.util.List<java.lang.String> exposedHeaders
@Nullable private java.lang.Boolean allowCredentials
@Nullable private java.lang.Long maxAge
public CorsConfiguration()
CorsConfiguration
instance with no cross-origin
requests allowed for any origin by default.applyPermitDefaultValues()
public CorsConfiguration(CorsConfiguration other)
CorsConfiguration
instance by copying all
values from the supplied CorsConfiguration
.public void setAllowedOrigins(@Nullable java.util.List<java.lang.String> allowedOrigins)
"http://domain1.com"
.
The special value "*"
allows all domains.
By default this is not set.
@Nullable public java.util.List<java.lang.String> getAllowedOrigins()
null
if none.addAllowedOrigin(String)
,
setAllowedOrigins(List)
public void addAllowedOrigin(java.lang.String origin)
public void setAllowedMethods(@Nullable java.util.List<java.lang.String> allowedMethods)
"GET"
, "POST"
,
"PUT"
, etc.
The special value "*"
allows all methods.
If not set, only "GET"
and "HEAD"
are allowed.
By default this is not set.
@Nullable public java.util.List<java.lang.String> getAllowedMethods()
null
in which case
only "GET"
and "HEAD"
allowed.public void addAllowedMethod(HttpMethod method)
public void addAllowedMethod(java.lang.String method)
public void setAllowedHeaders(@Nullable java.util.List<java.lang.String> allowedHeaders)
The special value "*"
allows actual requests to send any
header.
A header name is not required to be listed if it is one of:
Cache-Control
, Content-Language
, Expires
,
Last-Modified
, or Pragma
.
By default this is not set.
@Nullable public java.util.List<java.lang.String> getAllowedHeaders()
null
if none.addAllowedHeader(String)
,
setAllowedHeaders(List)
public void addAllowedHeader(java.lang.String allowedHeader)
public void setExposedHeaders(@Nullable java.util.List<java.lang.String> exposedHeaders)
Cache-Control
, Content-Language
, Content-Type
,
Expires
, Last-Modified
, or Pragma
) that an
actual response might have and can be exposed.
Note that "*"
is not a valid exposed header value.
By default this is not set.
@Nullable public java.util.List<java.lang.String> getExposedHeaders()
null
if none.addExposedHeader(String)
,
setExposedHeaders(List)
public void addExposedHeader(java.lang.String exposedHeader)
Note that "*"
is not a valid exposed header value.
public void setAllowCredentials(@Nullable java.lang.Boolean allowCredentials)
By default this is not set (i.e. user credentials are not supported).
@Nullable public java.lang.Boolean getAllowCredentials()
allowCredentials
flag, or null
if none.setAllowCredentials(Boolean)
public void setMaxAge(@Nullable java.lang.Long maxAge)
By default this is not set.
@Nullable public java.lang.Long getMaxAge()
maxAge
value, or null
if none.setMaxAge(Long)
public CorsConfiguration applyPermitDefaultValues()
CorsConfiguration
does not permit any
cross-origin requests and must be configured explicitly to indicate what
should be allowed.
Use this method to flip the initialization model to start with open defaults that permit all cross-origin requests for GET, HEAD, and POST requests. Note however that this method will not override any existing values already set.
The following defaults are applied if not already set:
GET
, HEAD
and POST
.@Nullable public CorsConfiguration combine(@Nullable CorsConfiguration other)
CorsConfiguration
with this one.
When combining single values like allowCredentials
or
maxAge
, this
properties are overridden by non-null
other
properties if any.
Combining lists like allowedOrigins
, allowedMethods
,
allowedHeaders
or exposedHeaders
is done in an additive
way. For example, combining ["GET", "POST"]
with
["PATCH"]
results in ["GET", "POST", "PATCH"]
, but keep
in mind that combining ["GET", "POST"]
with ["*"]
results in ["*"]
.
Notice that default permit values set by
applyPermitDefaultValues()
are overridden by
any value explicitly defined.
CorsConfiguration
or this
configuration if the supplied configuration is null
private java.util.List<java.lang.String> combine(@Nullable java.util.List<java.lang.String> source, @Nullable java.util.List<java.lang.String> other)
@Nullable public java.lang.String checkOrigin(@Nullable java.lang.String requestOrigin)
requestOrigin
- the origin to checknull
which
means the request origin is not allowed@Nullable public java.util.List<HttpMethod> checkHttpMethod(@Nullable HttpMethod requestMethod)
Access-Control-Request-Method
header on a pre-flight request)
against the configured allowed methods.requestMethod
- the HTTP request method to checknull
if the supplied requestMethod
is not allowed@Nullable public java.util.List<java.lang.String> checkHeaders(@Nullable java.util.List<java.lang.String> requestHeaders)
Access-Control-Request-Headers
of a pre-flight request) against
the configured allowed headers.requestHeaders
- the request headers to checknull
if none of the supplied request headers is allowed