org.springframework.web.bind.annotation

Annotation Type CrossOrigin

@Target(value={METHOD,TYPE})
 @Retention(value=RUNTIME)
 @Documented
public @interface CrossOrigin

Marks the annotated method or type as permitting cross origin requests.

By default all origins and headers are permitted, credentials are not allowed, and the maximum age is set to 1800 seconds (30 minutes). The list of HTTP methods is set to the methods on the @RequestMapping if not explicitly set on @CrossOrigin.

NOTE: @CrossOrigin is processed if an appropriate HandlerMapping-HandlerAdapter pair is configured such as the RequestMappingHandlerMapping-RequestMappingHandlerAdapter pair which are the default in the MVC Java config and the MVC namespace.

Since:

4.2

Author:

Russell Allen, Sebastien Deleuze, Sam Brannen

Field Summary

Fields

Modifier and Type	Fields and Description
static boolean	DEFAULT_ALLOW_CREDENTIALS Deprecated. as of Spring 5.0, in favor of using CorsConfiguration.applyPermitDefaultValues()
static java.lang.String[]	DEFAULT_ALLOWED_HEADERS Deprecated. as of Spring 5.0, in favor of using CorsConfiguration.applyPermitDefaultValues()
static long	DEFAULT_MAX_AGE Deprecated. as of Spring 5.0, in favor of using CorsConfiguration.applyPermitDefaultValues()
static java.lang.String[]	DEFAULT_ORIGINS Deprecated. as of Spring 5.0, in favor of using CorsConfiguration.applyPermitDefaultValues()

Optional Element Summary

Optional Elements

Modifier and Type	Optional Element and Description
java.lang.String	allowCredentials Whether the browser should include any cookies associated with the domain of the request being annotated.
java.lang.String[]	allowedHeaders List of request headers that can be used during the actual request.
java.lang.String[]	exposedHeaders List of response headers that the user-agent will allow the client to access.
long	maxAge The maximum age (in seconds) of the cache duration for pre-flight responses.
RequestMethod[]	methods List of supported HTTP request methods, e.g.
java.lang.String[]	origins List of allowed origins, e.g.
java.lang.String[]	value Alias for origins().

Field Detail

DEFAULT_ORIGINS

@Deprecated
public static final java.lang.String[] DEFAULT_ORIGINS

Deprecated. as of Spring 5.0, in favor of using CorsConfiguration.applyPermitDefaultValues()

DEFAULT_ALLOWED_HEADERS

@Deprecated
public static final java.lang.String[] DEFAULT_ALLOWED_HEADERS

Deprecated. as of Spring 5.0, in favor of using CorsConfiguration.applyPermitDefaultValues()

DEFAULT_ALLOW_CREDENTIALS

@Deprecated
public static final boolean DEFAULT_ALLOW_CREDENTIALS

Deprecated. as of Spring 5.0, in favor of using CorsConfiguration.applyPermitDefaultValues()

DEFAULT_MAX_AGE

@Deprecated
public static final long DEFAULT_MAX_AGE

Deprecated. as of Spring 5.0, in favor of using CorsConfiguration.applyPermitDefaultValues()

Element Detail

value

@AliasFor(value="origins")
public abstract java.lang.String[] value

Alias for origins().

Default:

{}

origins

@AliasFor(value="value")
public abstract java.lang.String[] origins

List of allowed origins, e.g. "http://domain1.com".

These values are placed in the Access-Control-Allow-Origin header of both the pre-flight response and the actual response. "*" means that all origins are allowed.

If undefined, all origins are allowed.

See Also:

value()

Default:

{}

allowedHeaders

public abstract java.lang.String[] allowedHeaders

List of request headers that can be used during the actual request.

This property controls the value of the pre-flight response's Access-Control-Allow-Headers header. "*" means that all headers requested by the client are allowed.

If undefined, all requested headers are allowed.

Default:

{}

exposedHeaders

public abstract java.lang.String[] exposedHeaders

List of response headers that the user-agent will allow the client to access.

This property controls the value of actual response's Access-Control-Expose-Headers header.

If undefined, an empty exposed header list is used.

Default:

{}

methods

public abstract RequestMethod[] methods

List of supported HTTP request methods, e.g. "{RequestMethod.GET, RequestMethod.POST}".

Methods specified here override those specified via RequestMapping.

If undefined, methods defined by RequestMapping annotation are used.

Default:

{}

allowCredentials

public abstract java.lang.String allowCredentials

Whether the browser should include any cookies associated with the domain of the request being annotated. Be aware that enabling this option could increase the surface attack of the web application (for example via exposing sensitive user-specific information like CSRF tokens).

Set to "true" means that the pre-flight response will include the header Access-Control-Allow-Credentials=true so such cookies should be included.

If undefined or set to "false", such header is not included and credentials are not allowed.

Default:

""

maxAge

public abstract long maxAge

The maximum age (in seconds) of the cache duration for pre-flight responses.

This property controls the value of the Access-Control-Max-Age header in the pre-flight response.

Setting this to a reasonable value can reduce the number of pre-flight request/response interactions required by the browser. A negative value means undefined.

If undefined, max age is set to 1800 seconds (i.e., 30 minutes).

Default:

-1L