Class OriginHandshakeInterceptor

java.lang.Object

org.springframework.web.socket.server.support.OriginHandshakeInterceptor

All Implemented Interfaces:

HandshakeInterceptor

public class OriginHandshakeInterceptor
extends Object
implements HandshakeInterceptor

An interceptor to check request Origin header value against a collection of allowed origins.

Since:

4.1.2

Author:

Sebastien Deleuze

Field Summary

Fields

Modifier and Type	Field	Description
protected final org.apache.commons.logging.Log	logger

Constructor Summary

Constructors

Constructor	Description
OriginHandshakeInterceptor()	Default constructor with only same origin requests allowed.
OriginHandshakeInterceptor(Collection<String> allowedOrigins)	Constructor using the specified allowed origin values.

Method Summary

Modifier and Type	Method	Description
void	afterHandshake(ServerHttpRequest request, ServerHttpResponse response, WebSocketHandler wsHandler, @Nullable Exception exception)	Invoked after the handshake is done.
boolean	beforeHandshake(ServerHttpRequest request, ServerHttpResponse response, WebSocketHandler wsHandler, Map<String,Object> attributes)	Invoked before the handshake is processed.
Collection<String>	getAllowedOriginPatterns()	Return the configured allowed origin patterns.
Collection<String>	getAllowedOrigins()	Return the configured allowed origins.
void	setAllowedOriginPatterns(Collection<String> allowedOriginPatterns)	Alternative to setAllowedOrigins(Collection) that supports more flexible patterns for specifying the origins for which cross-origin requests are allowed from a browser.
void	setAllowedOrigins(Collection<String> allowedOrigins)	Set the origins for which cross-origin requests are allowed from a browser.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

logger

protected final org.apache.commons.logging.Log logger

Constructor Details

OriginHandshakeInterceptor

public OriginHandshakeInterceptor()

Default constructor with only same origin requests allowed.

OriginHandshakeInterceptor

public OriginHandshakeInterceptor(Collection<String> allowedOrigins)

Constructor using the specified allowed origin values.

See Also:

• setAllowedOrigins(Collection)

Method Details

setAllowedOrigins

public void setAllowedOrigins(Collection<String> allowedOrigins)

Set the origins for which cross-origin requests are allowed from a browser. Please, refer to CorsConfiguration.setAllowedOrigins(List) for format details and considerations, and keep in mind that the CORS spec does not allow use of "*" with allowCredentials=true. For more flexible origin patterns use setAllowedOriginPatterns(Collection) instead.

By default, no origins are allowed. When allowedOriginPatterns is also set, then that takes precedence over this property.

Note when SockJS is enabled and origins are restricted, transport types that do not allow to check request origin (Iframe based transports) are disabled. As a consequence, IE 6 to 9 are not supported when origins are restricted.

See Also:

• setAllowedOriginPatterns(Collection)
• RFC 6454: The Web Origin Concept

getAllowedOrigins

public Collection<String> getAllowedOrigins()

Return the configured allowed origins.

Since:

4.1.5

setAllowedOriginPatterns

public void setAllowedOriginPatterns(Collection<String> allowedOriginPatterns)

Alternative to setAllowedOrigins(Collection) that supports more flexible patterns for specifying the origins for which cross-origin requests are allowed from a browser. Please, refer to CorsConfiguration.setAllowedOriginPatterns(List) for format details and other considerations.

By default this is not set.

Since:

5.3.2

getAllowedOriginPatterns

public Collection<String> getAllowedOriginPatterns()

Return the configured allowed origin patterns.

Since:

5.3.2

beforeHandshake

public boolean beforeHandshake(ServerHttpRequest request,
 ServerHttpResponse response,
 WebSocketHandler wsHandler,
 Map<String,Object> attributes)
                        throws Exception

Description copied from interface: HandshakeInterceptor

Invoked before the handshake is processed.

Specified by:

beforeHandshake in interface HandshakeInterceptor

Parameters:

request - the current request

response - the current response

wsHandler - the target WebSocket handler

attributes - the attributes from the HTTP handshake to associate with the WebSocket session; the provided attributes are copied, the original map is not used.

Returns:

whether to proceed with the handshake (true) or abort (false)

Throws:

Exception

afterHandshake

public void afterHandshake(ServerHttpRequest request,
 ServerHttpResponse response,
 WebSocketHandler wsHandler,
 @Nullable Exception exception)

Description copied from interface: HandshakeInterceptor

Invoked after the handshake is done. The response status and headers indicate the results of the handshake, i.e. whether it was successful or not.

Specified by:

afterHandshake in interface HandshakeInterceptor

Parameters:

request - the current request

response - the current response

wsHandler - the target WebSocket handler

exception - an exception raised during the handshake, or null if none