Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Ensure local @CrossOrigin maxAge overrides global value

Browse Source 
Prior to this commit, a method-level @CrossOrigin maxAge value did not
override a class-level @CrossOrigin maxAge value. This contradicts the
Javadoc for @CrossOrgin which states the following.

    For those attributes where only a single value can be accepted such
    as allowCredentials and maxAge, the local overrides the global
    value.

This commit ensures that a method-level @CrossOrigin maxAge value
overrides a class-level @CrossOrigin maxAge value.

Closes gh-26619
This commit is contained in:
GungnirLaevatain
2021-02-27 17:44:02 +08:00
committed by Sam Brannen
parent 428dbc43da
commit e8f685ecc8
4 changed files with 69 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/RequestMappingHandlerMapping.java
View File

@@ -456,7 +456,7 @@ public class RequestMappingHandlerMapping extends RequestMappingInfoHandlerMappi
"or an empty string (\"\"): current value is [" + allowCredentials + "]");
}
if (annotation.maxAge() >= 0 && config.getMaxAge() == null) {
if (annotation.maxAge() >= 0) {
config.setMaxAge(annotation.maxAge());
}
}

35
spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/CrossOriginTests.java
View File

@@ -310,6 +310,27 @@ public class CrossOriginTests {
assertThat(this.handlerMapping.getHandler(request)).isNull();
}
@Test
public void maxAgeWithDefaultOrigin() throws Exception {
this.handlerMapping.registerHandler(new MaxAgeWithDefaultOriginController());
this.request.setRequestURI("/classAge");
HandlerExecutionChain chain = this.handlerMapping.getHandler(request);
CorsConfiguration config = getCorsConfiguration(chain, false);
assertThat(config).isNotNull();
assertThat(config.getAllowedMethods()).containsExactly("GET");
assertThat(config.getAllowedOrigins()).containsExactly("*");
assertThat(config.getMaxAge()).isEqualTo(10);
this.request.setRequestURI("/methodAge");
chain = this.handlerMapping.getHandler(request);
config = getCorsConfiguration(chain, false);
assertThat(config).isNotNull();
assertThat(config.getAllowedMethods()).containsExactly("GET");
assertThat(config.getAllowedOrigins()).containsExactly("*");
assertThat(config.getMaxAge()).isEqualTo(100);
}
private CorsConfiguration getCorsConfiguration(HandlerExecutionChain chain, boolean isPreFlightRequest) {
if (isPreFlightRequest) {
@@ -425,7 +446,21 @@ public class CrossOriginTests {
@RequestMapping(path = "/baz", method = RequestMethod.GET)
public void baz() {
}
}
@Controller
@CrossOrigin(maxAge = 10)
private static class MaxAgeWithDefaultOriginController {
@CrossOrigin
@RequestMapping(path = "/classAge", method = RequestMethod.GET)
public void classAge() {
}
@CrossOrigin(maxAge = 100)
@RequestMapping(path = "/methodAge", method = RequestMethod.GET)
public void methodAge() {
}
}