Package org.springframework.web.bind.annotation

Annotation Interface CrossOrigin

@Target({TYPE,METHOD}) @Retention(RUNTIME) @Documented public @interface CrossOrigin
Annotation for permitting cross-origin requests on specific handler classes and/or handler methods. Processed if an appropriate HandlerMapping is configured.

Both Spring Web MVC and Spring WebFlux support this annotation through the RequestMappingHandlerMapping in their respective modules. The values from each type and method level pair of annotations are added to a CorsConfiguration and then default values are applied via CorsConfiguration.applyPermitDefaultValues().

The rules for combining global and local configuration are generally additive -- e.g. all global and all local origins. For those attributes where only a single value can be accepted such as allowCredentials and maxAge, the local overrides the global value. See CorsConfiguration.combine(CorsConfiguration) for more details.

Since:
4.2
Author:
Russell Allen, Sebastien Deleuze, Sam Brannen, Ruslan Akhundov

  • Optional Element Summary

    Optional Elements
    Modifier and Type
    Optional Element
    Description
    String
    allowCredentials
    Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint.
    String[]
    allowedHeaders
    The list of request headers that are permitted in actual requests, possibly "*" to allow all headers.
    String[]
    exposedHeaders
    The List of response headers that the user-agent will allow the client to access on an actual response, other than "simple" headers, i.e.
    long
    maxAge
    The maximum age (in seconds) of the cache duration for preflight responses.
    RequestMethod[]
    methods
    The list of supported HTTP request methods.
    String[]
    originPatterns
    Alternative to origins() that supports more flexible origin patterns.
    String[]
    origins
    A list of origins for which cross-origin requests are allowed.
    String[]
    value
    Alias for origins().

  • Element Details

    • value

      @AliasFor("origins") String[] value
      Alias for origins().
      Default:
      {}

    • origins

      @AliasFor("value") String[] origins
      A list of origins for which cross-origin requests are allowed. Please, see CorsConfiguration.setAllowedOrigins(List) for details.

      By default all origins are allowed unless originPatterns() is also set in which case originPatterns is used instead.

      Default:
      {}

    • originPatterns

      String[] originPatterns
      Alternative to origins() that supports more flexible origin patterns. Please, see CorsConfiguration.setAllowedOriginPatterns(List) for details.

      By default this is not set.

      Since:
      5.3
      Default:
      {}

    • allowedHeaders

      String[] allowedHeaders
      The list of request headers that are permitted in actual requests, possibly "*" to allow all headers.

      Allowed headers are listed in the Access-Control-Allow-Headers response header of preflight requests.

      A header name is not required to be listed if it is one of: Cache-Control, Content-Language, Expires, Last-Modified, or Pragma as per the CORS spec.

      By default all requested headers are allowed.

      Default:
      {}

    • exposedHeaders

      String[] exposedHeaders
      The List of response headers that the user-agent will allow the client to access on an actual response, other than "simple" headers, i.e. Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, or Pragma,

      Exposed headers are listed in the Access-Control-Expose-Headers response header of actual CORS requests.

      The special value "*" allows all headers to be exposed for non-credentialed requests.

      By default no headers are listed as exposed.

      Default:
      {}

    • methods

      RequestMethod[] methods
      The list of supported HTTP request methods.

      By default the supported methods are the same as the ones to which a controller method is mapped.

      Default:
      {}

    • allowCredentials

      String allowCredentials
      Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint. The configured value is set on the Access-Control-Allow-Credentials response header of preflight requests.

      NOTE: Be aware that this option establishes a high level of trust with the configured domains and also increases the surface attack of the web application by exposing sensitive user-specific information such as cookies and CSRF tokens.

      By default this is not set in which case the Access-Control-Allow-Credentials header is also not set and credentials are therefore not allowed.

      Default:
      ""

    • maxAge

      long maxAge
      The maximum age (in seconds) of the cache duration for preflight responses.

      This property controls the value of the Access-Control-Max-Age response header of preflight requests.

      Setting this to a reasonable value can reduce the number of preflight request/response interactions required by the browser. A negative value means undefined.

      By default this is set to 1800 seconds (30 minutes).

      Default:
      -1L