public class DefaultCorsProcessor extends java.lang.Object implements CorsProcessor
CorsProcessor
,
as defined by the CORS W3C recommendation.
Note that when input CorsConfiguration
is null
, this
implementation does not reject simple or actual requests outright but simply
avoid adding CORS headers to the response. CORS processing is also skipped
if the response already contains CORS headers.
Modifier and Type | Field and Description |
---|---|
private static Log |
logger |
private static java.util.List<java.lang.String> |
VARY_HEADERS |
Constructor and Description |
---|
DefaultCorsProcessor() |
Modifier and Type | Method and Description |
---|---|
protected java.util.List<java.lang.String> |
checkHeaders(CorsConfiguration config,
java.util.List<java.lang.String> requestHeaders)
Check the headers and determine the headers for the response of a
pre-flight request.
|
protected java.util.List<HttpMethod> |
checkMethods(CorsConfiguration config,
HttpMethod requestMethod)
Check the HTTP method and determine the methods for the response of a
pre-flight request.
|
protected java.lang.String |
checkOrigin(CorsConfiguration config,
java.lang.String requestOrigin)
Check the origin and determine the origin for the response.
|
private java.util.List<java.lang.String> |
getHeadersToUse(ServerHttpRequest request,
boolean isPreFlight) |
private HttpMethod |
getMethodToUse(ServerHttpRequest request,
boolean isPreFlight) |
protected boolean |
handleInternal(ServerWebExchange exchange,
CorsConfiguration config,
boolean preFlightRequest)
Handle the given request.
|
boolean |
process(CorsConfiguration config,
ServerWebExchange exchange)
Process a request using the given
CorsConfiguration . |
protected void |
rejectRequest(ServerHttpResponse response)
Invoked when one of the CORS checks failed.
|
private static final Log logger
private static final java.util.List<java.lang.String> VARY_HEADERS
public boolean process(@Nullable CorsConfiguration config, ServerWebExchange exchange)
CorsProcessor
CorsConfiguration
.process
in interface CorsProcessor
config
- the CORS configuration to use; possibly null
in which case pre-flight requests are rejected, but all others allowed.exchange
- the current exchangefalse
if the request was rejected, true
otherwiseprotected void rejectRequest(ServerHttpResponse response)
protected boolean handleInternal(ServerWebExchange exchange, CorsConfiguration config, boolean preFlightRequest)
@Nullable protected java.lang.String checkOrigin(CorsConfiguration config, @Nullable java.lang.String requestOrigin)
CorsConfiguration.checkOrigin(String)
.@Nullable protected java.util.List<HttpMethod> checkMethods(CorsConfiguration config, @Nullable HttpMethod requestMethod)
CorsConfiguration.checkOrigin(String)
.@Nullable private HttpMethod getMethodToUse(ServerHttpRequest request, boolean isPreFlight)
@Nullable protected java.util.List<java.lang.String> checkHeaders(CorsConfiguration config, java.util.List<java.lang.String> requestHeaders)
CorsConfiguration.checkOrigin(String)
.private java.util.List<java.lang.String> getHeadersToUse(ServerHttpRequest request, boolean isPreFlight)