Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add an option to disable automatic addition of CORS header

Browse Source 
Issues: SPR-12283
This commit is contained in:
Sebastien Deleuze
2014-10-26 00:36:41 +02:00
parent 743356fa21
commit 58f4014b17
10 changed files with 110 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spring-websocket/src/main/java/org/springframework/web/socket/config/WebSocketNamespaceUtils.java
View File

@@ -145,6 +145,10 @@ class WebSocketNamespaceUtils {
if (!attrValue.isEmpty()) {
sockJsServiceDef.getPropertyValues().add("messageCodec", new RuntimeBeanReference(attrValue));
}
attrValue = sockJsElement.getAttribute("suppress-cors");
if (!attrValue.isEmpty()) {
sockJsServiceDef.getPropertyValues().add("suppressCors", Boolean.valueOf(attrValue));
}
sockJsServiceDef.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
String sockJsServiceName = context.getReaderContext().registerWithGeneratedName(sockJsServiceDef);
return new RuntimeBeanReference(sockJsServiceName);

16
spring-websocket/src/main/java/org/springframework/web/socket/config/annotation/SockJsServiceRegistration.java
View File

@@ -64,6 +64,8 @@ public class SockJsServiceRegistration {
private final List<String> allowedOrigins = new ArrayList<String>();
private Boolean suppressCors;
private SockJsMessageCodec messageCodec;
@@ -204,6 +206,17 @@ public class SockJsServiceRegistration {
return this;
}
/**
* This option can be used to disable automatic addition of CORS headers for
* SockJS requests.
* <p>The default value is "false".
* @since 4.1.2
*/
public SockJsServiceRegistration setSupressCors(boolean suppressCors) {
this.suppressCors = suppressCors;
return this;
}
/**
* The codec to use for encoding and decoding SockJS messages.
* <p>By default {@code Jackson2SockJsMessageCodec} is used requiring the
@@ -251,6 +264,9 @@ public class SockJsServiceRegistration {
if (this.webSocketEnabled != null) {
service.setWebSocketEnabled(this.webSocketEnabled);
}
if (this.suppressCors != null) {
service.setSuppressCors(this.suppressCors);
}
if (!this.allowedOrigins.isEmpty()) {
service.setAllowedOrigins(this.allowedOrigins);
}

22
spring-websocket/src/main/java/org/springframework/web/socket/sockjs/support/AbstractSockJsService.java
View File

@@ -88,6 +88,8 @@ public abstract class AbstractSockJsService implements SockJsService {
private final List<String> allowedOrigins = new ArrayList<String>(Arrays.asList("*"));
private boolean suppressCors = false;
public AbstractSockJsService(TaskScheduler scheduler) {
Assert.notNull(scheduler, "TaskScheduler must not be null");
@@ -293,6 +295,24 @@ public abstract class AbstractSockJsService implements SockJsService {
return Collections.unmodifiableList(allowedOrigins);
}
/**
* This option can be used to disable automatic addition of CORS headers for
* SockJS requests.
* <p>The default value is "false".
* @since 4.1.2
*/
public void setSuppressCors(boolean suppressCors) {
this.suppressCors = suppressCors;
}
/**
* @since 4.1.2
* @see #setSuppressCors(boolean)
*/
public boolean shouldSuppressCors() {
return this.suppressCors;
}
/**
* This method determines the SockJS path and handles SockJS static URLs.
* Session URLs and raw WebSocket requests are delegated to abstract methods.
@@ -426,7 +446,7 @@ public abstract class AbstractSockJsService implements SockJsService {
// See SPR-11919 and https://issues.jboss.org/browse/WFLY-3474
}
if(origin != null && !hasCorsResponseHeaders) {
if(!this.suppressCors && origin != null && !hasCorsResponseHeaders) {
addCorsHeaders(request, response, httpMethods);
}
return true;

8
spring-websocket/src/main/resources/org/springframework/web/socket/config/spring-websocket-4.1.xsd
View File

@@ -232,6 +232,14 @@
]]></xsd:documentation>
</xsd:annotation>
</xsd:attribute>
<xsd:attribute name="suppress-cors" type="xsd:string">
<xsd:annotation>
<xsd:documentation source="java:org.springframework.web.socket.sockjs.support.AbstractSockJsService"><![CDATA[
This option can be used to disable automatic addition of CORS headers for SockJS requests.
The default value is "false".
]]></xsd:documentation>
</xsd:annotation>
</xsd:attribute>
</xsd:complexType>
<xsd:complexType name="stomp-broker-relay">