Package org.springframework.web.filter

Class CorsFilter

java.lang.Object

org.springframework.web.filter.GenericFilterBean

org.springframework.web.filter.OncePerRequestFilter

org.springframework.web.filter.CorsFilter

All Implemented Interfaces:

Filter, Aware, BeanNameAware, DisposableBean, InitializingBean, EnvironmentAware, EnvironmentCapable, ServletContextAware

public class CorsFilter
extends OncePerRequestFilter

Filter to handle CORS pre-flight requests and intercept CORS simple and actual requests with a CorsProcessor, and to update the response, e.g. with CORS response headers, based on the policy matched through the provided CorsConfigurationSource.

This is an alternative to configuring CORS in the Spring MVC Java config and the Spring MVC XML namespace. It is useful for applications depending only on spring-web (not on spring-webmvc) or for security constraints that require CORS checks to be performed at Filter level.

This filter could be used in conjunction with DelegatingFilterProxy in order to help with its initialization.

Since:

4.2

Author:

Sebastien Deleuze

See Also:

• CORS W3C recommendation
• UrlBasedCorsConfigurationSource

Field Summary

Fields inherited from class org.springframework.web.filter.OncePerRequestFilter

ALREADY_FILTERED_SUFFIX

Fields inherited from class org.springframework.web.filter.GenericFilterBean

logger

Constructor Summary

Constructors

Constructor	Description
CorsFilter(CorsConfigurationSource configSource)	Constructor accepting a CorsConfigurationSource used by the filter to find the CorsConfiguration to use for each incoming request.

Method Summary

Modifier and Type	Method	Description
protected void	doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)	Same contract as for doFilter, but guaranteed to be just invoked once per request within a single request thread.
void	setCorsProcessor(CorsProcessor processor)	Configure a custom CorsProcessor to use to apply the matched CorsConfiguration for a request.

Methods inherited from class org.springframework.web.filter.OncePerRequestFilter

doFilter, doFilterNestedErrorDispatch, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted, shouldNotFilter, shouldNotFilterAsyncDispatch, shouldNotFilterErrorDispatch

Methods inherited from class org.springframework.web.filter.GenericFilterBean

addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CorsFilter

public CorsFilter(CorsConfigurationSource configSource)

Constructor accepting a CorsConfigurationSource used by the filter to find the CorsConfiguration to use for each incoming request.

See Also:

• UrlBasedCorsConfigurationSource

Method Details

setCorsProcessor

public void setCorsProcessor(CorsProcessor processor)

Configure a custom CorsProcessor to use to apply the matched CorsConfiguration for a request.

By default DefaultCorsProcessor is used.

doFilterInternal

protected void doFilterInternal(HttpServletRequest request,
 HttpServletResponse response,
 FilterChain filterChain)
                         throws ServletException,
IOException

Description copied from class: OncePerRequestFilter

Same contract as for doFilter, but guaranteed to be just invoked once per request within a single request thread. See OncePerRequestFilter.shouldNotFilterAsyncDispatch() for details.

Provides HttpServletRequest and HttpServletResponse arguments instead of the default ServletRequest and ServletResponse ones.

Specified by:

doFilterInternal in class OncePerRequestFilter

Throws:

ServletException

IOException