org.springframework.web.bind.annotation

Annotation Type CrossOrigin

@Target(value={TYPE,METHOD})
 @Retention(value=RUNTIME)
 @Documented
public @interface CrossOrigin

Annotation for permitting cross-origin requests on specific handler classes and/or handler methods. Processed if an appropriate HandlerMapping is configured.

Both Spring Web MVC and Spring WebFlux support this annotation through the RequestMappingHandlerMapping in their respective modules. The values from each type and method level pair of annotations are added to a CorsConfiguration and then default values are applied via CorsConfiguration.applyPermitDefaultValues().

The rules for combining global and local configuration are generally additive -- e.g. all global and all local origins. For those attributes where only a single value can be accepted such as allowCredentials and maxAge, the local overrides the global value. See CorsConfiguration.combine(CorsConfiguration) for more details.

Since:

4.2

Author:

Russell Allen, Sebastien Deleuze, Sam Brannen, Ruslan Akhundov

Field Summary

Fields

Modifier and Type	Fields and Description
static boolean	DEFAULT_ALLOW_CREDENTIALS Deprecated. as of Spring 5.0, in favor of CorsConfiguration.applyPermitDefaultValues()
static String[]	DEFAULT_ALLOWED_HEADERS Deprecated. as of Spring 5.0, in favor of CorsConfiguration.applyPermitDefaultValues()
static long	DEFAULT_MAX_AGE Deprecated. as of Spring 5.0, in favor of CorsConfiguration.applyPermitDefaultValues()
static String[]	DEFAULT_ORIGINS Deprecated. as of Spring 5.0, in favor of CorsConfiguration.applyPermitDefaultValues()

Optional Element Summary

Optional Elements

Modifier and Type	Optional Element and Description
String	allowCredentials Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint.
String[]	allowedHeaders The list of request headers that are permitted in actual requests, possibly "*" to allow all headers.
String	allowPrivateNetwork Whether private network access is supported.
String[]	exposedHeaders The List of response headers that the user-agent will allow the client to access on an actual response, possibly "*" to expose all headers.
long	maxAge The maximum age (in seconds) of the cache duration for preflight responses.
RequestMethod[]	methods The list of supported HTTP request methods.
String[]	originPatterns Alternative to origins() that supports more flexible origin patterns.
String[]	origins A list of origins for which cross-origin requests are allowed.
String[]	value Alias for origins().

Field Detail

DEFAULT_ORIGINS

@Deprecated
public static final String[] DEFAULT_ORIGINS

Deprecated. as of Spring 5.0, in favor of CorsConfiguration.applyPermitDefaultValues()

DEFAULT_ALLOWED_HEADERS

@Deprecated
public static final String[] DEFAULT_ALLOWED_HEADERS

Deprecated. as of Spring 5.0, in favor of CorsConfiguration.applyPermitDefaultValues()

DEFAULT_ALLOW_CREDENTIALS

@Deprecated
public static final boolean DEFAULT_ALLOW_CREDENTIALS

Deprecated. as of Spring 5.0, in favor of CorsConfiguration.applyPermitDefaultValues()

DEFAULT_MAX_AGE

@Deprecated
public static final long DEFAULT_MAX_AGE

Deprecated. as of Spring 5.0, in favor of CorsConfiguration.applyPermitDefaultValues()

Element Detail

value

@AliasFor(value="origins")
public abstract String[] value

Alias for origins().

Default:

{}

origins

@AliasFor(value="value")
public abstract String[] origins

A list of origins for which cross-origin requests are allowed. Please, see CorsConfiguration.setAllowedOrigins(List) for details.

By default all origins are allowed unless originPatterns() is also set in which case originPatterns is used instead.

Default:

{}

originPatterns

public abstract String[] originPatterns

Alternative to origins() that supports more flexible origin patterns. Please, see CorsConfiguration.setAllowedOriginPatterns(List) for details.

By default this is not set.

Since:

5.3

Default:

{}

allowedHeaders

public abstract String[] allowedHeaders

The list of request headers that are permitted in actual requests, possibly "*" to allow all headers. Please, see CorsConfiguration.setAllowedHeaders(List) for details.

By default all requested headers are allowed.

Default:

{}

exposedHeaders

public abstract String[] exposedHeaders

The List of response headers that the user-agent will allow the client to access on an actual response, possibly "*" to expose all headers. Please, see CorsConfiguration.setExposedHeaders(List) for details.

By default no headers are listed as exposed.

Default:

{}

methods

public abstract RequestMethod[] methods

The list of supported HTTP request methods. Please, see CorsConfiguration.setAllowedMethods(List) for details.

By default the supported methods are the same as the ones to which a controller method is mapped.

Default:

{}

allowCredentials

public abstract String allowCredentials

Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint. Please, see CorsConfiguration.setAllowCredentials(Boolean) for details.

NOTE: Be aware that this option establishes a high level of trust with the configured domains and also increases the surface attack of the web application by exposing sensitive user-specific information such as cookies and CSRF tokens.

By default this is not set in which case the Access-Control-Allow-Credentials header is also not set and credentials are therefore not allowed.

Default:

""

allowPrivateNetwork

public abstract String allowPrivateNetwork

Whether private network access is supported. Please, see CorsConfiguration.setAllowPrivateNetwork(Boolean) for details.

By default this is not set (i.e. private network access is not supported).

Since:

5.3.32

Default:

""

maxAge

public abstract long maxAge

The maximum age (in seconds) of the cache duration for preflight responses.

This property controls the value of the Access-Control-Max-Age response header of preflight requests.

Setting this to a reasonable value can reduce the number of preflight request/response interactions required by the browser. A negative value means undefined.

By default this is set to 1800 seconds (30 minutes).

Default:

-1L