Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add Access-Control-Request-Method check for CORS preflight requests

Browse Source 
Issue: SPR-13193
This commit is contained in:
Sebastien Deleuze
2015-07-07 09:34:39 +02:00
parent aea23e42c7
commit 8ee0e78980
3 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
spring-web/src/main/java/org/springframework/web/cors/CorsUtils.java
View File

@@ -41,7 +41,8 @@ public class CorsUtils {
* Returns {@code true} if the request is a valid CORS pre-flight one.
*/
public static boolean isPreFlightRequest(HttpServletRequest request) {
return (isCorsRequest(request) && request.getMethod().equals(HttpMethod.OPTIONS.name()));
return (isCorsRequest(request) && request.getMethod().equals(HttpMethod.OPTIONS.name())
&& request.getHeader(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD) != null);
}
}