Add CORS support

This commit introduces support for CORS in Spring Framework.

Cross-origin resource sharing (CORS) is a mechanism that allows
many resources (e.g. fonts, JavaScript, etc.) on a web page to
be requested from another domain outside the domain from which
the resource originated. It is defined by the CORS W3C
recommandation (http://www.w3.org/TR/cors/).

A new annotation @CrossOrigin allows to enable CORS support
on Controller type or method level. By default all origins
("*") are allowed.

@RestController
public class SampleController {

	@CrossOrigin
	@RequestMapping("/foo")
	public String foo() {
		// ...
	}
}

Various @CrossOrigin attributes allow to customize the CORS configuration.

@RestController
public class SampleController {

	@CrossOrigin(origin = { "http://site1.com", "http://site2.com" },
				 allowedHeaders = { "header1", "header2" },
				 exposedHeaders = { "header1", "header2" },
				 method = RequestMethod.DELETE,
				 maxAge = 123, allowCredentials = "true")
	@RequestMapping(value = "/foo", method = { RequestMethod.GET, RequestMethod.POST} )
	public String foo() {
		// ...
	}
}

A CorsConfigurationSource interface can be implemented by HTTP request
handlers that want to support CORS by providing a CorsConfiguration
that will be detected at AbstractHandlerMapping level. See for
example ResourceHttpRequestHandler that implements this interface.

Global CORS configuration should be supported through ControllerAdvice
(with type level @CrossOrigin annotated class or class implementing
CorsConfigurationSource), or with XML namespace and JavaConfig
configuration, but this is not implemented yet.

Issue: SPR-9278

spring-webmvc/src/main/java/org/springframework/web/servlet/FrameworkServlet.java

@@ -903,7 +903,7 @@ public abstract class FrameworkServlet extends HttpServletBean implements Applic
 	protected void doOptions(HttpServletRequest request, HttpServletResponse response)
 			throws ServletException, IOException {
 
-		if (this.dispatchOptionsRequest) {
+		if (this.dispatchOptionsRequest || request.getHeader("Origin") != null) {
 			processRequest(request, response);
 			if (response.containsHeader("Allow")) {
 				// Proper OPTIONS response coming from a handler - we're done.

spring-webmvc/src/main/java/org/springframework/web/servlet/handler/AbstractHandlerMapping.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-2015 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,14 +16,20 @@
 
 package org.springframework.web.servlet.handler;
 
+import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 
 import org.springframework.beans.BeansException;
 import org.springframework.beans.factory.BeanFactoryUtils;
 import org.springframework.core.Ordered;
+import org.springframework.web.HttpRequestHandler;
+import org.springframework.web.cors.CorsProcessor;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.util.AntPathMatcher;
 import org.springframework.util.Assert;
 import org.springframework.util.PathMatcher;
@@ -32,6 +38,8 @@ import org.springframework.web.context.support.WebApplicationObjectSupport;
 import org.springframework.web.servlet.HandlerExecutionChain;
 import org.springframework.web.servlet.HandlerInterceptor;
 import org.springframework.web.servlet.HandlerMapping;
+import org.springframework.web.cors.DefaultCorsProcessor;
+import org.springframework.web.cors.CorsUtils;
 import org.springframework.web.util.UrlPathHelper;
 
 /**
@@ -71,6 +79,8 @@ public abstract class AbstractHandlerMapping extends WebApplicationObjectSupport
 
 	private final List<MappedInterceptor> mappedInterceptors = new ArrayList<MappedInterceptor>();
 
+	private CorsProcessor corsProcessor = new DefaultCorsProcessor();
+
 
 	/**
 	 * Specify the order value for this HandlerMapping bean.
@@ -184,6 +194,13 @@ public abstract class AbstractHandlerMapping extends WebApplicationObjectSupport
 		this.interceptors.addAll(Arrays.asList(interceptors));
 	}
 
+	/**
+	 * @since 4.2
+	 */
+	public void setCorsProcessor(CorsProcessor corsProcessor) {
+		Assert.notNull(corsProcessor, "CorsProcessor must not be null");
+		this.corsProcessor = corsProcessor;
+	}
 
 	/**
 	 * Initializes the interceptors.
@@ -308,16 +325,29 @@ public abstract class AbstractHandlerMapping extends WebApplicationObjectSupport
 			String handlerName = (String) handler;
 			handler = getApplicationContext().getBean(handlerName);
 		}
-		return getHandlerExecutionChain(handler, request);
+		HandlerExecutionChain executionChain = getHandlerExecutionChain(handler, request);
+		if (CorsUtils.isCorsRequest(request)) {
+			CorsConfiguration config = getCorsConfiguration(handler, request);
+			executionChain = getCorsHandlerExecutionChain(request, executionChain, config);
+		}
+		return executionChain;
 	}
 
 	/**
 	 * Look up a handler for the given request, returning {@code null} if no
 	 * specific one is found. This method is called by {@link #getHandler};
 	 * a {@code null} return value will lead to the default handler, if one is set.
+	 *
+	 * <p>On CORS pre-flight requests this method should return a match not for
+	 * the pre-flight request but for the expected actual request based on the URL
+	 * path, the HTTP methods from the "Access-Control-Request-Method" header, and
+	 * the headers from the "Access-Control-Request-Headers" header thus allowing
+	 * the CORS configuration to be obtained via {@link #getCorsConfiguration},
+	 *
 	 * <p>Note: This method may also return a pre-built {@link HandlerExecutionChain},
 	 * combining a handler object with dynamically determined interceptors.
 	 * Statically specified interceptors will get merged into such an existing chain.
+	 *
 	 * @param request current HTTP request
 	 * @return the corresponding handler instance, or {@code null} if none found
 	 * @throws Exception if there is an internal error
@@ -358,4 +388,72 @@ public abstract class AbstractHandlerMapping extends WebApplicationObjectSupport
 		return chain;
 	}
 
+	/**
+	 * Retrieve the CORS configuration for the given handler.
+	 */
+	protected CorsConfiguration getCorsConfiguration(Object handler, HttpServletRequest request) {
+		handler = (handler instanceof HandlerExecutionChain) ? ((HandlerExecutionChain) handler).getHandler() : handler;
+		if (handler != null && handler instanceof CorsConfigurationSource) {
+			return ((CorsConfigurationSource) handler).getCorsConfiguration(request);
+		}
+		return null;
+	}
+
+	/**
+	 * Update the HandlerExecutionChain for CORS-related handling.
+	 *
+	 * <p>For pre-flight requests, the default implementation replaces the selected
+	 * handler with a simple HttpRequestHandler that invokes the configured
+	 * {@link #setCorsProcessor}.
+	 *
+	 * <p>For actual requests, the default implementation inserts a
+	 * HandlerInterceptor that makes CORS-related checks and adds CORS headers.
+	 */
+	protected HandlerExecutionChain getCorsHandlerExecutionChain(HttpServletRequest request,
+			HandlerExecutionChain chain, CorsConfiguration config) {
+
+		if (config != null) {
+			if (CorsUtils.isPreFlightRequest(request)) {
+				HandlerInterceptor[] interceptors = chain.getInterceptors();
+				chain = new HandlerExecutionChain(new PreFlightHandler(config), interceptors);
+			}
+			else {
+				chain.addInterceptor(new CorsInterceptor(config));
+			}
+		}
+		return chain;
+	}
+
+
+	private class PreFlightHandler implements HttpRequestHandler {
+
+		private final CorsConfiguration config;
+
+
+		public PreFlightHandler(CorsConfiguration config) {
+			this.config = config;
+		}
+
+		@Override
+		public void handleRequest(HttpServletRequest request, HttpServletResponse response) throws IOException {
+			corsProcessor.processPreFlightRequest(this.config, request, response);
+		}
+	}
+
+	private class CorsInterceptor extends HandlerInterceptorAdapter {
+
+		private final CorsConfiguration config;
+
+
+		public CorsInterceptor(CorsConfiguration config) {
+			this.config = config;
+		}
+
+		@Override
+		public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+			return corsProcessor.processActualRequest(this.config, request, response);
+		}
+
+	}
+
 }

spring-webmvc/src/main/java/org/springframework/web/servlet/handler/AbstractHandlerMethodMapping.java

@@ -35,6 +35,8 @@ import org.springframework.util.ClassUtils;
 import org.springframework.util.LinkedMultiValueMap;
 import org.springframework.util.MultiValueMap;
 import org.springframework.util.ReflectionUtils.MethodFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsUtils;
 import org.springframework.web.method.HandlerMethod;
 import org.springframework.web.method.HandlerMethodSelector;
 import org.springframework.web.servlet.HandlerMapping;
@@ -67,6 +69,9 @@ public abstract class AbstractHandlerMethodMapping<T> extends AbstractHandlerMap
 	 */
 	private static final String SCOPED_TARGET_NAME_PREFIX = "scopedTarget.";
 
+	private static final HandlerMethod PREFLIGHT_MULTI_MATCH_HANDLER_METHOD =
+			new HandlerMethod(new EmptyHandler(), ClassUtils.getMethod(EmptyHandler.class, "handle"));
+
 
 	private boolean detectHandlerMethodsInAncestorContexts = false;
 
@@ -78,6 +83,8 @@ public abstract class AbstractHandlerMethodMapping<T> extends AbstractHandlerMap
 
 	private final MultiValueMap<String, HandlerMethod> nameMap = new LinkedMultiValueMap<String, HandlerMethod>();
 
+	private final Map<Method, CorsConfiguration> corsConfigurations = new LinkedHashMap<Method, CorsConfiguration>();
+
 
 	/**
 	 * Whether to detect handler methods in beans in ancestor ApplicationContexts.
@@ -106,6 +113,20 @@ public abstract class AbstractHandlerMethodMapping<T> extends AbstractHandlerMap
 		return Collections.unmodifiableMap(this.handlerMethods);
 	}
 
+	protected Map<Method, CorsConfiguration> getCorsConfigurations() {
+		return corsConfigurations;
+	}
+
+	@Override
+	protected CorsConfiguration getCorsConfiguration(Object handler, HttpServletRequest request) {
+		CorsConfiguration config = super.getCorsConfiguration(handler, request);
+		if (config == null && handler instanceof HandlerMethod) {
+			HandlerMethod handlerMethod = (HandlerMethod)handler;
+			config = this.getCorsConfigurations().get(handlerMethod.getMethod());
+		}
+		return config;
+	}
+
 	/**
 	 * Return the handler methods mapped to the mapping with the given name.
 	 * @param mappingName the mapping name
@@ -144,9 +165,19 @@ public abstract class AbstractHandlerMethodMapping<T> extends AbstractHandlerMap
 				detectHandlerMethods(beanName);
 			}
 		}
+		registerMultiMatchCorsConfiguration();
 		handlerMethodsInitialized(getHandlerMethods());
 	}
 
+	private void registerMultiMatchCorsConfiguration() {
+		CorsConfiguration config = new CorsConfiguration();
+		config.addAllowedOrigin("*");
+		config.addAllowedMethod("*");
+		config.addAllowedHeader("*");
+		config.setAllowCredentials(true);
+		this.corsConfigurations.put(PREFLIGHT_MULTI_MATCH_HANDLER_METHOD.getMethod(), config);
+	}
+
 	/**
 	 * Whether the given type is a handler with handler methods.
 	 * @param beanType the type of the bean being checked
@@ -228,6 +259,15 @@ public abstract class AbstractHandlerMethodMapping<T> extends AbstractHandlerMap
 			String name = this.namingStrategy.getName(newHandlerMethod, mapping);
 			updateNameMap(name, newHandlerMethod);
 		}
+
+		CorsConfiguration config  = initCorsConfiguration(handler, method, mapping);
+		if (config != null) {
+			this.corsConfigurations.put(method, config);
+		}
+	}
+
+	protected CorsConfiguration initCorsConfiguration(Object handler, Method method, T mappingInfo) {
+		return null;
 	}
 
 	private void updateNameMap(String name, HandlerMethod newHandlerMethod) {
@@ -333,6 +373,9 @@ public abstract class AbstractHandlerMethodMapping<T> extends AbstractHandlerMap
 			}
 			Match bestMatch = matches.get(0);
 			if (matches.size() > 1) {
+				if (CorsUtils.isPreFlightRequest(request)) {
+					return PREFLIGHT_MULTI_MATCH_HANDLER_METHOD;
+				}
 				Match secondBestMatch = matches.get(1);
 				if (comparator.compare(bestMatch, secondBestMatch) == 0) {
 					Method m1 = bestMatch.handlerMethod.getMethod();
@@ -436,4 +479,13 @@ public abstract class AbstractHandlerMethodMapping<T> extends AbstractHandlerMap
 		}
 	}
 
+
+	private static class EmptyHandler {
+
+		public void handle() {
+			throw new UnsupportedOperationException("not implemented");
+		}
+
+	}
+
 }

spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/RequestMappingInfo.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-2015 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,8 @@ package org.springframework.web.servlet.mvc.method;
 import javax.servlet.http.HttpServletRequest;
 
 import org.springframework.util.StringUtils;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.cors.CorsUtils;
 import org.springframework.web.servlet.mvc.condition.ConsumesRequestCondition;
 import org.springframework.web.servlet.mvc.condition.HeadersRequestCondition;
 import org.springframework.web.servlet.mvc.condition.ParamsRequestCondition;
@@ -208,7 +210,15 @@ public final class RequestMappingInfo implements RequestCondition<RequestMapping
 		ProducesRequestCondition produces = this.producesCondition.getMatchingCondition(request);
 
 		if (methods == null || params == null || headers == null || consumes == null || produces == null) {
-			return null;
+			if (CorsUtils.isPreFlightRequest(request)) {
+				methods = getAccessControlRequestMethodCondition(request);
+				if (methods == null || params == null) {
+					return null;
+				}
+			}
+			else {
+				return null;
+			}
 		}
 
 		PatternsRequestCondition patterns = this.patternsCondition.getMatchingCondition(request);
@@ -225,6 +235,21 @@ public final class RequestMappingInfo implements RequestCondition<RequestMapping
 				methods, params, headers, consumes, produces, custom.getCondition());
 	}
 
+	/**
+	 * Return a matching RequestMethodsRequestCondition based on the expected
+	 * HTTP method specified in a CORS pre-flight request.
+	 */
+	private RequestMethodsRequestCondition getAccessControlRequestMethodCondition(HttpServletRequest request) {
+		String expectedMethod = request.getHeader(CorsUtils.ACCESS_CONTROL_REQUEST_METHOD);
+		if (StringUtils.hasText(expectedMethod)) {
+			for (RequestMethod method : getMethodsCondition().getMethods()) {
+				if (expectedMethod.equalsIgnoreCase(method.name())) {
+					return new RequestMethodsRequestCondition(method);
+				}
+			}
+		}
+		return null;
+	}
 
 	/**
 	 * Compares "this" info (i.e. the current instance) with another info in the context of a request.

spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/RequestMappingHandlerMapping.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-2015 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,13 +24,19 @@ import org.springframework.context.EmbeddedValueResolverAware;
 import org.springframework.core.annotation.AnnotationUtils;
 import org.springframework.stereotype.Controller;
 import org.springframework.util.Assert;
+import org.springframework.util.CollectionUtils;
 import org.springframework.util.StringValueResolver;
 import org.springframework.web.accept.ContentNegotiationManager;
+import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.method.HandlerMethod;
 import org.springframework.web.servlet.mvc.condition.AbstractRequestCondition;
 import org.springframework.web.servlet.mvc.condition.CompositeRequestCondition;
 import org.springframework.web.servlet.mvc.condition.ConsumesRequestCondition;
 import org.springframework.web.servlet.mvc.condition.HeadersRequestCondition;
+import org.springframework.web.servlet.mvc.condition.NameValueExpression;
 import org.springframework.web.servlet.mvc.condition.ParamsRequestCondition;
 import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
 import org.springframework.web.servlet.mvc.condition.ProducesRequestCondition;
@@ -262,4 +268,61 @@ public class RequestMappingHandlerMapping extends RequestMappingInfoHandlerMappi
 		}
 	}
 
+	@Override
+	protected CorsConfiguration initCorsConfiguration(Object handler, Method method, RequestMappingInfo mappingInfo) {
+		HandlerMethod handlerMethod = createHandlerMethod(handler, method);
+
+		CorsConfiguration config = new CorsConfiguration();
+
+		CrossOrigin typeAnnotation = AnnotationUtils.findAnnotation(handlerMethod.getBeanType(), CrossOrigin.class);
+		applyAnnotation(config, typeAnnotation);
+
+		CrossOrigin methodAnnotation = AnnotationUtils.findAnnotation(method, CrossOrigin.class);
+		applyAnnotation(config, methodAnnotation);
+
+		if (CollectionUtils.isEmpty(config.getAllowedMethods())) {
+			for (RequestMethod allowedMethod : mappingInfo.getMethodsCondition().getMethods()) {
+				config.addAllowedMethod(allowedMethod.name());
+			}
+		}
+		if (CollectionUtils.isEmpty(config.getAllowedHeaders())) {
+			for (NameValueExpression<String> headerExpression : mappingInfo.getHeadersCondition().getExpressions()) {
+				if (!headerExpression.isNegated()) {
+					config.addAllowedHeader(headerExpression.getName());
+				}
+			}
+		}
+		return config;
+	}
+
+	private void applyAnnotation(CorsConfiguration config, CrossOrigin annotation) {
+		if (annotation == null) {
+			return;
+		}
+		for (String origin : annotation.origin()) {
+			config.addAllowedOrigin(origin);
+		}
+		for (RequestMethod method : annotation.method()) {
+			config.addAllowedMethod(method.name());
+		}
+		for (String header : annotation.allowedHeaders()) {
+			config.addAllowedHeader(header);
+		}
+		for (String header : annotation.exposedHeaders()) {
+			config.addExposedHeader(header);
+		}
+		if (annotation.allowCredentials().equalsIgnoreCase("true")) {
+			config.setAllowCredentials(true);
+		}
+		else if (annotation.allowCredentials().equalsIgnoreCase("false")) {
+			config.setAllowCredentials(false);
+		}
+		else if (!annotation.allowCredentials().isEmpty()) {
+			throw new IllegalStateException("AllowCredentials value must be \"true\", \"false\" or \"\" (empty string), current value is " + annotation.allowCredentials());
+		}
+		if (annotation.maxAge() != -1 && config.getMaxAge() == null) {
+			config.setMaxAge(annotation.maxAge());
+		}
+	}
+
 }

spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java

@@ -38,7 +38,9 @@ import org.springframework.core.io.Resource;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpRange;
 import org.springframework.http.MediaType;
+import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.http.server.ServletServerHttpRequest;
+import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;
 import org.springframework.util.CollectionUtils;
@@ -88,7 +90,7 @@ import org.springframework.web.servlet.support.WebContentGenerator;
  * @author Arjen Poutsma
  * @since 3.0.4
  */
-public class ResourceHttpRequestHandler extends WebContentGenerator implements HttpRequestHandler, InitializingBean {
+public class ResourceHttpRequestHandler extends WebContentGenerator implements HttpRequestHandler, InitializingBean, CorsConfigurationSource {
 
 	private static final String CONTENT_ENCODING = "Content-Encoding";
 
@@ -104,6 +106,8 @@ public class ResourceHttpRequestHandler extends WebContentGenerator implements H
 
 	private final List<ResourceTransformer> resourceTransformers = new ArrayList<ResourceTransformer>(4);
 
+	private CorsConfiguration corsConfiguration;
+
 
 	public ResourceHttpRequestHandler() {
 		super(METHOD_GET, METHOD_HEAD);
@@ -162,6 +166,9 @@ public class ResourceHttpRequestHandler extends WebContentGenerator implements H
 		return this.resourceTransformers;
 	}
 
+	public void setCorsConfiguration(CorsConfiguration corsConfiguration) {
+		this.corsConfiguration = corsConfiguration;
+	}
 
 	@Override
 	public void afterPropertiesSet() throws Exception {
@@ -172,6 +179,11 @@ public class ResourceHttpRequestHandler extends WebContentGenerator implements H
 		initAllowedLocations();
 	}
 
+	@Override
+	public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {
+		return corsConfiguration;
+	}
+
 	/**
 	 * Look for a {@link org.springframework.web.servlet.resource.PathResourceResolver}
 	 * among the {@link #getResourceResolvers() resource resolvers} and configure