org.springframework.web.filter

Class CorsFilter

java.lang.Object

org.springframework.web.filter.GenericFilterBean

org.springframework.web.filter.OncePerRequestFilter

org.springframework.web.filter.CorsFilter

All Implemented Interfaces:

Filter, Aware, BeanNameAware, DisposableBean, InitializingBean, EnvironmentAware, EnvironmentCapable, ServletContextAware

public class CorsFilter
extends OncePerRequestFilter

Filter that handles CORS preflight requests and intercepts CORS simple and actual requests thanks to a CorsProcessor implementation (DefaultCorsProcessor by default) in order to add the relevant CORS response headers (like Access-Control-Allow-Origin) using the provided CorsConfigurationSource (for example an UrlBasedCorsConfigurationSource instance.

This is an alternative to Spring MVC Java config and XML namespace CORS configuration, useful for applications depending only on spring-web (not on spring-webmvc) or for security constraints requiring CORS checks to be performed at Filter level.

This filter could be used in conjunction with DelegatingFilterProxy in order to help with its initialization.

Since:

4.2

Author:

Sebastien Deleuze

See Also:

CORS W3C recommendation

Field Summary

Fields inherited from class org.springframework.web.filter.OncePerRequestFilter

ALREADY_FILTERED_SUFFIX

Fields inherited from class org.springframework.web.filter.GenericFilterBean

logger

Constructor Summary

Constructors

Constructor and Description
CorsFilter(CorsConfigurationSource configSource) Constructor accepting a CorsConfigurationSource used by the filter to find the CorsConfiguration to use for each incoming request.

Method Summary

Modifier and Type	Method and Description
protected void	doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) Same contract as for doFilter, but guaranteed to be just invoked once per request within a single request thread.
void	setCorsProcessor(CorsProcessor processor) Configure a custom CorsProcessor to use to apply the matched CorsConfiguration for a request.

Methods inherited from class org.springframework.web.filter.OncePerRequestFilter

doFilter, doFilterNestedErrorDispatch, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted, shouldNotFilter, shouldNotFilterAsyncDispatch, shouldNotFilterErrorDispatch

Methods inherited from class org.springframework.web.filter.GenericFilterBean

addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CorsFilter

public CorsFilter(CorsConfigurationSource configSource)

Constructor accepting a CorsConfigurationSource used by the filter to find the CorsConfiguration to use for each incoming request.

See Also:

UrlBasedCorsConfigurationSource

Method Detail

setCorsProcessor

public void setCorsProcessor(CorsProcessor processor)

Configure a custom CorsProcessor to use to apply the matched CorsConfiguration for a request.

By default DefaultCorsProcessor is used.

doFilterInternal

protected void doFilterInternal(HttpServletRequest request,
                                HttpServletResponse response,
                                FilterChain filterChain)
                         throws ServletException,
                                IOException

Description copied from class: OncePerRequestFilter

Same contract as for doFilter, but guaranteed to be just invoked once per request within a single request thread. See OncePerRequestFilter.shouldNotFilterAsyncDispatch() for details.

Provides HttpServletRequest and HttpServletResponse arguments instead of the default ServletRequest and ServletResponse ones.

Specified by:

doFilterInternal in class OncePerRequestFilter

Throws:

ServletException

IOException