org.springframework.web.reactive.config

Class CorsRegistration

java.lang.Object

org.springframework.web.reactive.config.CorsRegistration

public class CorsRegistration
extends Object

Assists with the creation of a CorsConfiguration instance for a given URL path pattern.

Since:

5.0

Author:

Sebastien Deleuze, Rossen Stoyanchev

See Also:

CorsConfiguration, CorsRegistry

Constructor Summary

Constructors

Constructor and Description
CorsRegistration(String pathPattern)

Method Summary

Modifier and Type	Method and Description
CorsRegistration	allowCredentials(boolean allowCredentials) Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint.
CorsRegistration	allowedHeaders(String... headers) Set the list of headers that a pre-flight request can list as allowed for use during an actual request.
CorsRegistration	allowedMethods(String... methods) Set the HTTP methods to allow, e.g.
CorsRegistration	allowedOrigins(String... origins) The list of allowed origins that be specific origins, e.g.
CorsRegistration	exposedHeaders(String... headers) Set the list of response headers other than "simple" headers, i.e.
protected CorsConfiguration	getCorsConfiguration()
protected String	getPathPattern()
CorsRegistration	maxAge(long maxAge) Configure how long in seconds the response from a pre-flight request can be cached by clients.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CorsRegistration

public CorsRegistration(String pathPattern)

Method Detail

allowedOrigins

public CorsRegistration allowedOrigins(String... origins)

The list of allowed origins that be specific origins, e.g. "https://domain1.com", or "*" for all origins.

A matched origin is listed in the Access-Control-Allow-Origin response header of preflight actual CORS requests.

By default all origins are allowed.

Note: CORS checks use values from "Forwarded" (RFC 7239), "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers, if present, in order to reflect the client-originated address. Consider using the ForwardedHeaderFilter in order to choose from a central place whether to extract and use, or to discard such headers. See the Spring Framework reference for more on this filter.

allowedMethods

public CorsRegistration allowedMethods(String... methods)

Set the HTTP methods to allow, e.g. "GET", "POST", etc.

The special value "*" allows all methods.

By default "simple" methods GET, HEAD, and POST are allowed.

allowedHeaders

public CorsRegistration allowedHeaders(String... headers)

Set the list of headers that a pre-flight request can list as allowed for use during an actual request.

The special value "*" may be used to allow all headers.

A header name is not required to be listed if it is one of: Cache-Control, Content-Language, Expires, Last-Modified, or Pragma as per the CORS spec.

By default all headers are allowed.

exposedHeaders

public CorsRegistration exposedHeaders(String... headers)

Set the list of response headers other than "simple" headers, i.e. Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, or Pragma, that an actual response might have and can be exposed.

Note that "*" is not supported on this property.

By default this is not set.

allowCredentials

public CorsRegistration allowCredentials(boolean allowCredentials)

Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint. The configured value is set on the Access-Control-Allow-Credentials response header of preflight requests.

NOTE: Be aware that this option establishes a high level of trust with the configured domains and also increases the surface attack of the web application by exposing sensitive user-specific information such as cookies and CSRF tokens.

By default this is not set in which case the Access-Control-Allow-Credentials header is also not set and credentials are therefore not allowed.

maxAge

public CorsRegistration maxAge(long maxAge)

Configure how long in seconds the response from a pre-flight request can be cached by clients.

By default this is set to 1800 seconds (30 minutes).

getPathPattern

protected String getPathPattern()

getCorsConfiguration

protected CorsConfiguration getCorsConfiguration()