Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Refine CORS documentation for wildcard processing

Browse Source 
This commit refines CORS wildcard processing Javadoc to
provides more details on how wildcards are handled for
Access-Control-Allow-Methods, Access-Control-Allow-Headers
and Access-Control-Expose-Headers CORS headers.

For Access-Control-Expose-Headers, it is not possible to copy
the response headers which are not available at the point
when the CorsProcessor is invoked. Since all the major browsers
seem to support wildcard including on requests with credentials,
and since this is ultimately the user-agent responsibility to
check on client-side what is authorized or not, Spring Framework
continues to support this use case.

See gh-31168
This commit is contained in:
Sébastien Deleuze
2023-09-11 15:34:46 +02:00
parent 39c225c813
commit 75faf698af
6 changed files with 79 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
spring-webmvc/src/main/java/org/springframework/web/servlet/config/annotation/CorsRegistration.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2021 the original author or authors.
* Copyright 2002-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -77,9 +77,11 @@ public class CorsRegistration {
/**
* Set the HTTP methods to allow, e.g. {@code "GET"}, {@code "POST"}, etc.
* <p>The special value {@code "*"} allows all methods.
* <p>By default "simple" methods {@code GET}, {@code HEAD}, and {@code POST}
* The special value {@code "*"} allows all methods. By default,
* "simple" methods {@code GET}, {@code HEAD}, and {@code POST}
* are allowed.
* <p>Please, see {@link CorsConfiguration#setAllowedMethods(List)} for
* details.
*/
public CorsRegistration allowedMethods(String... methods) {
this.config.setAllowedMethods(Arrays.asList(methods));
@@ -88,11 +90,10 @@ public class CorsRegistration {
/**
* Set the list of headers that a pre-flight request can list as allowed
* for use during an actual request.
* <p>The special value {@code "*"} may be used to allow all headers.
* <p>A header name is not required to be listed if it is one of:
* {@code Cache-Control}, {@code Content-Language}, {@code Expires},
* {@code Last-Modified}, or {@code Pragma} as per the CORS spec.
* for use during an actual request. The special value {@code "*"}
* may be used to allow all headers.
* <p>Please, see {@link CorsConfiguration#setAllowedHeaders(List)} for
* details.
* <p>By default all headers are allowed.
*/
public CorsRegistration allowedHeaders(String... headers) {
@@ -101,12 +102,11 @@ public class CorsRegistration {
}
/**
* Set the list of response headers other than "simple" headers, i.e.
* {@code Cache-Control}, {@code Content-Language}, {@code Content-Type},
* {@code Expires}, {@code Last-Modified}, or {@code Pragma}, that an
* actual response might have and can be exposed.
* <p>The special value {@code "*"} allows all headers to be exposed for
* non-credentialed requests.
* Set the list of response headers that an actual response might have and
* can be exposed. The special value {@code "*"} allows all headers to be
* exposed.
* <p>Please, see {@link CorsConfiguration#setExposedHeaders(List)} for
* details.
* <p>By default this is not set.
*/
public CorsRegistration exposedHeaders(String... headers) {