Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updates to CORS patterns contribution

Browse Source 
Closes gh-25016
This commit is contained in:
Rossen Stoyanchev
2020-07-08 13:18:11 +03:00
parent 1181bb1852
commit 0e4e25d227
24 changed files with 488 additions and 256 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
spring-webflux/src/test/java/org/springframework/web/reactive/config/CorsRegistryTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
package org.springframework.web.reactive.config;
import java.util.Arrays;
import java.util.Collections;
import java.util.Map;
import org.junit.jupiter.api.Test;
@@ -56,11 +57,20 @@ public class CorsRegistryTests {
assertThat(configs.size()).isEqualTo(1);
CorsConfiguration config = configs.get("/foo");
assertThat(config.getAllowedOrigins()).isEqualTo(Arrays.asList("https://domain2.com", "https://domain2.com"));
assertThat(config.getAllowedMethods()).isEqualTo(Arrays.asList("DELETE"));
assertThat(config.getAllowedMethods()).isEqualTo(Collections.singletonList("DELETE"));
assertThat(config.getAllowedHeaders()).isEqualTo(Arrays.asList("header1", "header2"));
assertThat(config.getExposedHeaders()).isEqualTo(Arrays.asList("header3", "header4"));
assertThat(config.getAllowCredentials()).isEqualTo(false);
assertThat(config.getMaxAge()).isEqualTo(Long.valueOf(3600));
}
@Test
public void allowCredentials() {
this.registry.addMapping("/foo").allowCredentials(true);
CorsConfiguration config = this.registry.getCorsConfigurations().get("/foo");
assertThat(config.getAllowedOrigins())
.as("Globally origins=\"*\" and allowCredentials=true should be possible")
.containsExactly("*");
}
}

7
spring-webflux/src/test/java/org/springframework/web/reactive/handler/CorsUrlHandlerMappingTests.java
View File

@@ -113,7 +113,7 @@ public class CorsUrlHandlerMappingTests {
@Test
public void actualRequestWithGlobalPatternCorsConfig() throws Exception {
CorsConfiguration mappedConfig = new CorsConfiguration();
mappedConfig.addAllowedOriginPattern(".*\\.domain2.com");
mappedConfig.addAllowedOriginPattern("https://*.domain2.com");
this.handlerMapping.setCorsConfigurations(Collections.singletonMap("/welcome.html", mappedConfig));
String origin = "https://example.domain2.com";
@@ -122,7 +122,8 @@ public class CorsUrlHandlerMappingTests {
assertThat(actual).isNotNull();
assertThat(actual).isSameAs(this.welcomeController);
assertThat(exchange.getResponse().getHeaders().getFirst(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN)).isEqualTo("https://example.domain2.com");
assertThat(exchange.getResponse().getHeaders().getFirst(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN))
.isEqualTo("https://example.domain2.com");
}
@Test
@@ -197,7 +198,7 @@ public class CorsUrlHandlerMappingTests {
@Override
public CorsConfiguration getCorsConfiguration(ServerWebExchange exchange) {
CorsConfiguration config = new CorsConfiguration();
config.addAllowedOrigin("*");
config.addAllowedOriginPattern("*");
config.setAllowCredentials(true);
return config;
}

6
spring-webflux/src/test/java/org/springframework/web/reactive/result/method/annotation/CrossOriginAnnotationIntegrationTests.java
View File

@@ -68,7 +68,7 @@ class CrossOriginAnnotationIntegrationTests extends AbstractRequestMappingIntegr
context.register(WebConfig.class);
Properties props = new Properties();
props.setProperty("myOrigin", "https://site1.com");
props.setProperty("myOriginPattern", ".*\\.com");
props.setProperty("myOriginPattern", "https://*.com");
context.getEnvironment().getPropertySources().addFirst(new PropertiesPropertySource("ps", props));
context.register(PropertySourcesPlaceholderConfigurer.class);
context.refresh();
@@ -358,7 +358,7 @@ class CrossOriginAnnotationIntegrationTests extends AbstractRequestMappingIntegr
return "placeholder";
}
@CrossOrigin(originPatterns = ".*\\.com")
@CrossOrigin(originPatterns = "https://*.com")
@GetMapping("/origin-pattern-value-attribute")
public String customOriginPatternDefinedViaValueAttribute() {
return "pattern-value-attribute";
@@ -388,7 +388,7 @@ class CrossOriginAnnotationIntegrationTests extends AbstractRequestMappingIntegr
return "bar";
}
@CrossOrigin(allowCredentials = "true")
@CrossOrigin(originPatterns = "*", allowCredentials = "true")
@GetMapping("/baz")
public String baz() {
return "baz";

10
spring-webflux/src/test/java/org/springframework/web/reactive/result/method/annotation/GlobalCorsConfigIntegrationTests.java
View File

@@ -161,8 +161,7 @@ class GlobalCorsConfigIntegrationTests extends AbstractRequestMappingIntegration
ResponseEntity<String> entity = performOptions("/ambiguous", this.headers, String.class);
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
assertThat(entity.getHeaders().getAccessControlAllowOrigin()).isEqualTo("http://localhost:9000");
assertThat(entity.getHeaders().getAccessControlAllowMethods())
.containsExactly(HttpMethod.GET);
assertThat(entity.getHeaders().getAccessControlAllowMethods()).containsExactly(HttpMethod.GET);
assertThat(entity.getHeaders().getAccessControlAllowCredentials()).isEqualTo(true);
assertThat(entity.getHeaders().get(HttpHeaders.VARY))
.containsExactly(HttpHeaders.ORIGIN, HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD,
@@ -177,12 +176,9 @@ class GlobalCorsConfigIntegrationTests extends AbstractRequestMappingIntegration
@Override
protected void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/cors-restricted")
.allowedOrigins("https://foo")
.allowedMethods("GET", "POST");
registry.addMapping("/cors-restricted").allowedOrigins("https://foo").allowedMethods("GET", "POST");
registry.addMapping("/cors");
registry.addMapping("/ambiguous")
.allowedMethods("GET", "POST");
registry.addMapping("/ambiguous").allowedMethods("GET", "POST");
}
}