org.springframework.web.cors.reactive

Class DefaultCorsProcessor

java.lang.Object

org.springframework.web.cors.reactive.DefaultCorsProcessor

All Implemented Interfaces:

CorsProcessor

public class DefaultCorsProcessor
extends java.lang.Object
implements CorsProcessor

The default implementation of CorsProcessor, as defined by the CORS W3C recommendation.

Note that when input CorsConfiguration is null, this implementation does not reject simple or actual requests outright but simply avoid adding CORS headers to the response. CORS processing is also skipped if the response already contains CORS headers, or if the request is detected as a same-origin one.

Since:

5.0

Author:

Sebastien Deleuze, Rossen Stoyanchev

Field Summary

Fields

Modifier and Type	Field and Description
private static Log	logger

Constructor Summary

Constructors

Constructor and Description
DefaultCorsProcessor()

Method Summary

Modifier and Type	Method and Description
protected java.util.List<java.lang.String>	checkHeaders(CorsConfiguration config, java.util.List<java.lang.String> requestHeaders) Check the headers and determine the headers for the response of a pre-flight request.
protected java.util.List<HttpMethod>	checkMethods(CorsConfiguration config, HttpMethod requestMethod) Check the HTTP method and determine the methods for the response of a pre-flight request.
protected java.lang.String	checkOrigin(CorsConfiguration config, java.lang.String requestOrigin) Check the origin and determine the origin for the response.
private java.util.List<java.lang.String>	getHeadersToUse(ServerHttpRequest request, boolean isPreFlight)
private HttpMethod	getMethodToUse(ServerHttpRequest request, boolean isPreFlight)
protected boolean	handleInternal(ServerWebExchange exchange, CorsConfiguration config, boolean preFlightRequest) Handle the given request.
boolean	process(CorsConfiguration config, ServerWebExchange exchange) Process a request using the given CorsConfiguration.
protected void	rejectRequest(ServerHttpResponse response) Invoked when one of the CORS checks failed.
private boolean	responseHasCors(ServerHttpResponse response)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

logger

private static final Log logger

Constructor Detail

DefaultCorsProcessor

public DefaultCorsProcessor()

Method Detail

process

public boolean process(@Nullable
                       CorsConfiguration config,
                       ServerWebExchange exchange)

Description copied from interface: CorsProcessor

Process a request using the given CorsConfiguration.

Specified by:

process in interface CorsProcessor

Parameters:

config - the CORS configuration to use; possibly null in which case pre-flight requests are rejected, but all others allowed.

exchange - the current exchange

Returns:

false if the request was rejected, true otherwise

responseHasCors

private boolean responseHasCors(ServerHttpResponse response)

rejectRequest

protected void rejectRequest(ServerHttpResponse response)

Invoked when one of the CORS checks failed.

handleInternal

protected boolean handleInternal(ServerWebExchange exchange,
                                 CorsConfiguration config,
                                 boolean preFlightRequest)

Handle the given request.

checkOrigin

@Nullable
protected java.lang.String checkOrigin(CorsConfiguration config,
                                                 @Nullable
                                                 java.lang.String requestOrigin)

Check the origin and determine the origin for the response. The default implementation simply delegates to CorsConfiguration.checkOrigin(String).

checkMethods

@Nullable
protected java.util.List<HttpMethod> checkMethods(CorsConfiguration config,
                                                            @Nullable
                                                            HttpMethod requestMethod)

Check the HTTP method and determine the methods for the response of a pre-flight request. The default implementation simply delegates to CorsConfiguration.checkOrigin(String).

getMethodToUse

@Nullable
private HttpMethod getMethodToUse(ServerHttpRequest request,
                                            boolean isPreFlight)

checkHeaders

@Nullable
protected java.util.List<java.lang.String> checkHeaders(CorsConfiguration config,
                                                                  java.util.List<java.lang.String> requestHeaders)

Check the headers and determine the headers for the response of a pre-flight request. The default implementation simply delegates to CorsConfiguration.checkOrigin(String).

getHeadersToUse

private java.util.List<java.lang.String> getHeadersToUse(ServerHttpRequest request,
                                                         boolean isPreFlight)