Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do not mention credentials as enabled by default in CorsRegistry

Browse Source 
Credentials are not enabled by default contrary to the javadocs. 
The credentials support must be enabled via #allowCredentials.

Closes gh-24691

Co-authored-by: Martin Dindoffer <martin.dindoffer@sigp.eu>
This commit is contained in:
mdindoffer
2020-03-13 15:21:53 +01:00
committed by GitHub
parent c5b8406def
commit c11dd4a839
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
spring-webmvc/src/main/java/org/springframework/web/servlet/config/annotation/CorsRegistry.java
View File

@@ -42,9 +42,8 @@ public class CorsRegistry {
*
* <p>Exact path mapping URIs (such as {@code "/admin"}) are supported as
* well as Ant-style path patterns (such as {@code "/admin/**"}).
* <p>By default, all origins, all headers, credentials and {@code GET},
* {@code HEAD}, and {@code POST} methods are allowed, and the max age
* is set to 30 minutes.
* <p>By default, all origins, all headers and {@code GET}, {@code HEAD},
* and {@code POST} methods are allowed, and the max age is set to 30 minutes.
*
* <p>The following defaults are applied to the {@link CorsRegistration}:
* <ul>