Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Better encapsulation for CORS default permit configuration

Browse Source 
This commit also improves CorsRegistration Javadoc.

Issue: SPR-14798
This commit is contained in:
Sebastien Deleuze
2016-10-18 14:49:12 +02:00
committed by Rossen Stoyanchev
parent 25e7cd577d
commit 50f2cda009
8 changed files with 160 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
spring-web-reactive/src/main/java/org/springframework/web/reactive/config/CorsRegistration.java
View File

@@ -19,18 +19,14 @@ package org.springframework.web.reactive.config;
import java.util.ArrayList;
import java.util.Arrays;
import org.springframework.http.HttpMethod;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.cors.CorsConfiguration;
/**
* Assists with the creation of a {@link CorsConfiguration} instance mapped to
* a path pattern.
*
* <p>If no path pattern is specified, by default cross-origin request handling
* is mapped to {@code "/**"}. Also by default, all origins, headers,
* credentials and {@code GET}, {@code HEAD}, and {@code POST} methods are
* allowed, while the max age is set to 30 minutes.
* <p>By default, all origins, headers, credentials and {@code GET}, {@code HEAD}, and
* {@code POST} methods are allowed, while the max age is set to 30 minutes.
*
* @author Sebastien Deleuze
* @since 5.0
@@ -43,44 +39,84 @@ public class CorsRegistration {
private final CorsConfiguration config;
/**
* Create a new {@link CorsRegistration} instance with all origins, headers, credentials
* and {@code GET}, {@code HEAD}, and {@code POST} methods allowed, and the max age
* set to 30 minutes on the specified path.
* @param pathPattern the path where the CORS configuration should apply. Exact path
* mapping URIs (such as {@code "/admin"}) are supported as well as Ant-style path
* patterns (such as {@code "/admin/**"}).
*/
public CorsRegistration(String pathPattern) {
this.pathPattern = pathPattern;
// Same implicit default values as the @CrossOrigin annotation + allows simple methods
this.config = new CorsConfiguration();
this.config.setAllowedOrigins(Arrays.asList(CrossOrigin.DEFAULT_ORIGINS));
this.config.setAllowedMethods(Arrays.asList(HttpMethod.GET.name(),
HttpMethod.HEAD.name(), HttpMethod.POST.name()));
this.config.setAllowedHeaders(Arrays.asList(CrossOrigin.DEFAULT_ALLOWED_HEADERS));
this.config.setAllowCredentials(CrossOrigin.DEFAULT_ALLOW_CREDENTIALS);
this.config.setMaxAge(CrossOrigin.DEFAULT_MAX_AGE);
this.config = new CorsConfiguration().applyDefaultPermitConfiguration();
}
/**
* Set the origins to allow, e.g. {@code "http://domain1.com"}.
* <p>The special value {@code "*"} allows all domains.
* <p>By default, all origins are allowed.
*/
public CorsRegistration allowedOrigins(String... origins) {
this.config.setAllowedOrigins(new ArrayList<>(Arrays.asList(origins)));
return this;
}
/**
* Set the HTTP methods to allow, e.g. {@code "GET"}, {@code "POST"},
* {@code "PUT"}, etc.
* <p>The special value {@code "*"} allows all methods.
* <p>By default, simple methods ({@code GET}, {@code HEAD}, and {@code POST}) are allowed.
*/
public CorsRegistration allowedMethods(String... methods) {
this.config.setAllowedMethods(new ArrayList<>(Arrays.asList(methods)));
return this;
}
/**
* Set the list of headers that a pre-flight request can list as allowed
* for use during an actual request.
* <p>The special value {@code "*"} allows actual requests to send any
* header.
* <p>A header name is not required to be listed if it is one of:
* {@code Cache-Control}, {@code Content-Language}, {@code Expires},
* {@code Last-Modified}, or {@code Pragma}.
* <p>By default, all headers are allowed.
*/
public CorsRegistration allowedHeaders(String... headers) {
this.config.setAllowedHeaders(new ArrayList<>(Arrays.asList(headers)));
return this;
}
/**
* Set the list of response headers other than simple headers (i.e.
* {@code Cache-Control}, {@code Content-Language}, {@code Content-Type},
* {@code Expires}, {@code Last-Modified}, or {@code Pragma}) that an
* actual response might have and can be exposed.
* <p>Note that {@code "*"} is not a valid exposed header value.
* <p>By default this is not set.
*/
public CorsRegistration exposedHeaders(String... headers) {
this.config.setExposedHeaders(new ArrayList<>(Arrays.asList(headers)));
return this;
}
/**
* Configure how long, in seconds, the response from a pre-flight request
* can be cached by clients.
* <p>By default, this is set to 1800 seconds (30 minutes).
*/
public CorsRegistration maxAge(long maxAge) {
this.config.setMaxAge(maxAge);
return this;
}
/**
* Whether user credentials are supported.
* <p>By default, this is set to {@code true} (i.e. user credentials are supported).
*/
public CorsRegistration allowCredentials(boolean allowCredentials) {
this.config.setAllowCredentials(allowCredentials);
return this;

16
spring-web-reactive/src/main/java/org/springframework/web/reactive/result/method/annotation/RequestMappingHandlerMapping.java
View File

@@ -18,7 +18,6 @@ package org.springframework.web.reactive.result.method.annotation;
import java.lang.reflect.AnnotatedElement;
import java.lang.reflect.Method;
import java.util.Arrays;
import java.util.Set;
import org.springframework.context.EmbeddedValueResolverAware;
@@ -294,25 +293,12 @@ public class RequestMappingHandlerMapping extends RequestMappingInfoHandlerMappi
updateCorsConfig(config, typeAnnotation);
updateCorsConfig(config, methodAnnotation);
if (CollectionUtils.isEmpty(config.getAllowedOrigins())) {
config.setAllowedOrigins(Arrays.asList(CrossOrigin.DEFAULT_ORIGINS));
}
if (CollectionUtils.isEmpty(config.getAllowedMethods())) {
for (RequestMethod allowedMethod : mappingInfo.getMethodsCondition().getMethods()) {
config.addAllowedMethod(allowedMethod.name());
}
}
if (CollectionUtils.isEmpty(config.getAllowedHeaders())) {
config.setAllowedHeaders(Arrays.asList(CrossOrigin.DEFAULT_ALLOWED_HEADERS));
}
if (config.getAllowCredentials() == null) {
config.setAllowCredentials(CrossOrigin.DEFAULT_ALLOW_CREDENTIALS);
}
if (config.getMaxAge() == null) {
config.setMaxAge(CrossOrigin.DEFAULT_MAX_AGE);
}
return config;
return config.applyDefaultPermitConfiguration();
}
private void updateCorsConfig(CorsConfiguration config, CrossOrigin annotation) {