diff --git a/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlCorsProperties.java b/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlCorsProperties.java new file mode 100644 index 00000000..3540004b --- /dev/null +++ b/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlCorsProperties.java @@ -0,0 +1,154 @@ +/* + * Copyright 2020-2021 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.graphql.boot; + +import java.time.Duration; +import java.time.temporal.ChronoUnit; +import java.util.ArrayList; +import java.util.List; + +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.boot.context.properties.PropertyMapper; +import org.springframework.boot.convert.DurationUnit; +import org.springframework.util.CollectionUtils; +import org.springframework.web.cors.CorsConfiguration; + +/** + * Configuration properties for GraphQL endpoint's CORS support. + * + * @author Andy Wilkinson + * @author Brian Clozel + * @since 1.0.0 + */ +@ConfigurationProperties(prefix = "spring.graphql.cors") +public class GraphQlCorsProperties { + /** + * Comma-separated list of origins to allow. '*' allows all origins. When credentials + * are allowed, '*' cannot be used and origin patterns should be configured instead. + * When no allowed origins or allowed origin patterns are set, CORS support is + * disabled. + */ + private List allowedOrigins = new ArrayList<>(); + + /** + * Comma-separated list of origin patterns to allow. Unlike allowed origins which only + * supports '*', origin patterns are more flexible (for example + * 'https://*.example.com') and can be used when credentials are allowed. When no + * allowed origin patterns or allowed origins are set, CORS support is disabled. + */ + private List allowedOriginPatterns = new ArrayList<>(); + + /** + * Comma-separated list of methods to allow. '*' allows all methods. When not set, + * defaults to GET. + */ + private List allowedMethods = new ArrayList<>(); + + /** + * Comma-separated list of headers to allow in a request. '*' allows all headers. + */ + private List allowedHeaders = new ArrayList<>(); + + /** + * Comma-separated list of headers to include in a response. + */ + private List exposedHeaders = new ArrayList<>(); + + /** + * Whether credentials are supported. When not set, credentials are not supported. + */ + private Boolean allowCredentials; + + /** + * How long the response from a pre-flight request can be cached by clients. If a + * duration suffix is not specified, seconds will be used. + */ + @DurationUnit(ChronoUnit.SECONDS) + private Duration maxAge = Duration.ofSeconds(1800); + + public List getAllowedOrigins() { + return this.allowedOrigins; + } + + public void setAllowedOrigins(List allowedOrigins) { + this.allowedOrigins = allowedOrigins; + } + + public List getAllowedOriginPatterns() { + return this.allowedOriginPatterns; + } + + public void setAllowedOriginPatterns(List allowedOriginPatterns) { + this.allowedOriginPatterns = allowedOriginPatterns; + } + + public List getAllowedMethods() { + return this.allowedMethods; + } + + public void setAllowedMethods(List allowedMethods) { + this.allowedMethods = allowedMethods; + } + + public List getAllowedHeaders() { + return this.allowedHeaders; + } + + public void setAllowedHeaders(List allowedHeaders) { + this.allowedHeaders = allowedHeaders; + } + + public List getExposedHeaders() { + return this.exposedHeaders; + } + + public void setExposedHeaders(List exposedHeaders) { + this.exposedHeaders = exposedHeaders; + } + + public Boolean getAllowCredentials() { + return this.allowCredentials; + } + + public void setAllowCredentials(Boolean allowCredentials) { + this.allowCredentials = allowCredentials; + } + + public Duration getMaxAge() { + return this.maxAge; + } + + public void setMaxAge(Duration maxAge) { + this.maxAge = maxAge; + } + + public CorsConfiguration toCorsConfiguration() { + if (CollectionUtils.isEmpty(this.allowedOrigins) && CollectionUtils.isEmpty(this.allowedOriginPatterns)) { + return null; + } + PropertyMapper map = PropertyMapper.get(); + CorsConfiguration configuration = new CorsConfiguration(); + map.from(this::getAllowedOrigins).to(configuration::setAllowedOrigins); + map.from(this::getAllowedOriginPatterns).to(configuration::setAllowedOriginPatterns); + map.from(this::getAllowedHeaders).whenNot(CollectionUtils::isEmpty).to(configuration::setAllowedHeaders); + map.from(this::getAllowedMethods).whenNot(CollectionUtils::isEmpty).to(configuration::setAllowedMethods); + map.from(this::getExposedHeaders).whenNot(CollectionUtils::isEmpty).to(configuration::setExposedHeaders); + map.from(this::getMaxAge).whenNonNull().as(Duration::getSeconds).to(configuration::setMaxAge); + map.from(this::getAllowCredentials).whenNonNull().to(configuration::setAllowCredentials); + return configuration; + } +} diff --git a/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlWebFluxAutoConfiguration.java b/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlWebFluxAutoConfiguration.java index 349d6a20..754fa262 100644 --- a/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlWebFluxAutoConfiguration.java +++ b/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlWebFluxAutoConfiguration.java @@ -31,6 +31,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; +import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.io.Resource; @@ -47,7 +48,10 @@ import org.springframework.http.HttpMethod; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; import org.springframework.http.codec.ServerCodecConfigurer; +import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.reactive.HandlerMapping; +import org.springframework.web.reactive.config.CorsRegistry; +import org.springframework.web.reactive.config.WebFluxConfigurer; import org.springframework.web.reactive.function.server.RouterFunction; import org.springframework.web.reactive.function.server.RouterFunctions; import org.springframework.web.reactive.function.server.ServerResponse; @@ -69,6 +73,7 @@ import static org.springframework.web.reactive.function.server.RequestPredicates @ConditionalOnClass({GraphQL.class, GraphQlHttpHandler.class}) @ConditionalOnBean(GraphQlSource.class) @AutoConfigureAfter(GraphQlServiceAutoConfiguration.class) +@EnableConfigurationProperties(GraphQlCorsProperties.class) public class GraphQlWebFluxAutoConfiguration { private static final Log logger = LogFactory.getLog(GraphQlWebFluxAutoConfiguration.class); @@ -147,4 +152,25 @@ public class GraphQlWebFluxAutoConfiguration { } + @Configuration(proxyBeanMethods = false) + public static class GraphQlEndpointCorsConfiguration implements WebFluxConfigurer { + + final GraphQlProperties graphql; + + final GraphQlCorsProperties cors; + + public GraphQlEndpointCorsConfiguration(GraphQlProperties graphql, GraphQlCorsProperties cors) { + this.graphql = graphql; + this.cors = cors; + } + + @Override + public void addCorsMappings(CorsRegistry registry) { + CorsConfiguration configuration = cors.toCorsConfiguration(); + if (configuration != null) { + registry.addMapping(graphql.getPath()).combine(configuration); + } + } + } + } diff --git a/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlWebMvcAutoConfiguration.java b/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlWebMvcAutoConfiguration.java index 598f3024..1cb641ef 100644 --- a/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlWebMvcAutoConfiguration.java +++ b/graphql-spring-boot-starter/src/main/java/org/springframework/graphql/boot/GraphQlWebMvcAutoConfiguration.java @@ -35,6 +35,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.http.HttpMessageConverters; +import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.io.Resource; @@ -52,7 +53,10 @@ import org.springframework.http.HttpMethod; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; import org.springframework.http.converter.GenericHttpMessageConverter; +import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.servlet.HandlerMapping; +import org.springframework.web.servlet.config.annotation.CorsRegistry; +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; import org.springframework.web.servlet.function.RouterFunction; import org.springframework.web.servlet.function.RouterFunctions; import org.springframework.web.servlet.function.ServerResponse; @@ -76,6 +80,7 @@ import static org.springframework.web.servlet.function.RequestPredicates.content @ConditionalOnClass({GraphQL.class, GraphQlHttpHandler.class}) @ConditionalOnBean(GraphQlSource.class) @AutoConfigureAfter(GraphQlServiceAutoConfiguration.class) +@EnableConfigurationProperties(GraphQlCorsProperties.class) public class GraphQlWebMvcAutoConfiguration { private static final Log logger = LogFactory.getLog(GraphQlWebMvcAutoConfiguration.class); @@ -168,4 +173,26 @@ public class GraphQlWebMvcAutoConfiguration { } + @Configuration(proxyBeanMethods = false) + public static class GraphQlEndpointCorsConfiguration implements WebMvcConfigurer { + + final GraphQlProperties graphql; + + final GraphQlCorsProperties cors; + + public GraphQlEndpointCorsConfiguration(GraphQlProperties graphql, GraphQlCorsProperties cors) { + this.graphql = graphql; + this.cors = cors; + } + + @Override + public void addCorsMappings(CorsRegistry registry) { + CorsConfiguration configuration = cors.toCorsConfiguration(); + if (configuration != null) { + registry.addMapping(graphql.getPath()).combine(configuration); + } + } + + } + } diff --git a/graphql-spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json b/graphql-spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json index 8ad70484..38f69f69 100644 --- a/graphql-spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json +++ b/graphql-spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json @@ -22,5 +22,46 @@ "description": "Whether percentile histograms should be published.", "defaultValue": false } + ], + "hints": [ + { + "name": "spring.graphql.cors.allowed-headers", + "values": [ + { + "value": "*" + } + ], + "providers": [ + { + "name": "any" + } + ] + }, + { + "name": "spring.graphql.cors.allowed-methods", + "values": [ + { + "value": "*" + } + ], + "providers": [ + { + "name": "any" + } + ] + }, + { + "name": "spring.graphql.cors.allowed-origins", + "values": [ + { + "value": "*" + } + ], + "providers": [ + { + "name": "any" + } + ] + } ] } \ No newline at end of file diff --git a/graphql-spring-boot-starter/src/test/java/org/springframework/graphql/boot/GraphQlWebFluxAutoConfigurationTests.java b/graphql-spring-boot-starter/src/test/java/org/springframework/graphql/boot/GraphQlWebFluxAutoConfigurationTests.java index 1f98acb5..7cf6db36 100644 --- a/graphql-spring-boot-starter/src/test/java/org/springframework/graphql/boot/GraphQlWebFluxAutoConfigurationTests.java +++ b/graphql-spring-boot-starter/src/test/java/org/springframework/graphql/boot/GraphQlWebFluxAutoConfigurationTests.java @@ -32,6 +32,7 @@ import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.graphql.execution.RuntimeWiringConfigurer; import org.springframework.graphql.web.WebInterceptor; +import org.springframework.http.HttpHeaders; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; import org.springframework.test.web.reactive.server.WebTestClient; @@ -50,7 +51,10 @@ class GraphQlWebFluxAutoConfigurationTests { .withPropertyValues( "spring.main.web-application-type=reactive", "spring.graphql.schema.printer.enabled=true", - "spring.graphql.schema.locations=classpath:books/"); + "spring.graphql.schema.locations=classpath:books/", + "spring.graphql.cors.allowed-origins=https://example.com", + "spring.graphql.cors.allowed-methods=POST", + "spring.graphql.cors.allow-credentials=true"); @Test void query() { @@ -144,6 +148,26 @@ class GraphQlWebFluxAutoConfigurationTests { .value(containsString("type Book"))); } + @Test + void corsConfiguration() { + testWithWebClient((client) -> { + String query = "{" + + " bookById(id: \\\"book-1\\\"){ " + + " id" + + " name" + + " pageCount" + + " author" + + " }" + + "}"; + client.post().uri("").bodyValue("{ \"query\": \"" + query + "\"}") + .header(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, "POST") + .header(HttpHeaders.ORIGIN, "https://example.com") + .exchange().expectStatus().isOk() + .expectHeader().valueEquals(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://example.com") + .expectHeader().valueEquals(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); ; + }); + } + private void testWithWebClient(Consumer consumer) { this.contextRunner.run((context) -> { WebTestClient client = WebTestClient.bindToApplicationContext(context) diff --git a/graphql-spring-boot-starter/src/test/java/org/springframework/graphql/boot/GraphQlWebMvcAutoConfigurationTests.java b/graphql-spring-boot-starter/src/test/java/org/springframework/graphql/boot/GraphQlWebMvcAutoConfigurationTests.java index 838fc87b..cc798d39 100644 --- a/graphql-spring-boot-starter/src/test/java/org/springframework/graphql/boot/GraphQlWebMvcAutoConfigurationTests.java +++ b/graphql-spring-boot-starter/src/test/java/org/springframework/graphql/boot/GraphQlWebMvcAutoConfigurationTests.java @@ -30,6 +30,7 @@ import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.graphql.execution.RuntimeWiringConfigurer; import org.springframework.graphql.web.WebInterceptor; +import org.springframework.http.HttpHeaders; import org.springframework.http.MediaType; import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MvcResult; @@ -54,7 +55,10 @@ class GraphQlWebMvcAutoConfigurationTests { .withPropertyValues( "spring.main.web-application-type=servlet", "spring.graphql.schema.printer.enabled=true", - "spring.graphql.schema.locations=classpath:books/"); + "spring.graphql.schema.locations=classpath:books/", + "spring.graphql.cors.allowed-origins=https://example.com", + "spring.graphql.cors.allowed-methods=POST", + "spring.graphql.cors.allow-credentials=true"); @Test void query() { @@ -128,6 +132,28 @@ class GraphQlWebMvcAutoConfigurationTests { .andExpect(content().string(Matchers.containsString("type Book")))); } + @Test + void corsConfiguration() { + testWith((mockMvc) -> { + String query = "{" + + " bookById(id: \\\"book-1\\\"){ " + + " id" + + " name" + + " pageCount" + + " author" + + " }" + + "}"; + MvcResult result = mockMvc.perform(post("/graphql") + .header(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, "POST") + .header(HttpHeaders.ORIGIN, "https://example.com") + .content("{\"query\": \"" + query + "\"}")).andReturn(); + mockMvc.perform(asyncDispatch(result)) + .andExpect(status().isOk()) + .andExpect(header().stringValues(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://example.com")) + .andExpect(header().stringValues(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true")); + }); + } + private void testWith(MockMvcConsumer mockMvcConsumer) { this.contextRunner.run((context) -> { MediaType mediaType = MediaType.APPLICATION_JSON; diff --git a/spring-graphql-docs/src/docs/asciidoc/attributes.adoc b/spring-graphql-docs/src/docs/asciidoc/attributes.adoc index 2cd93f1b..438516f7 100644 --- a/spring-graphql-docs/src/docs/asciidoc/attributes.adoc +++ b/spring-graphql-docs/src/docs/asciidoc/attributes.adoc @@ -16,5 +16,7 @@ :github-issues: https://github.com/{github-repo}/issues/ :github-main-branch: https://github.com/{github-repo}/tree/main :github-wiki: https://github.com/{github-repo}/wiki +:javadoc: https://docs.spring.io/spring-graphql/docs/{spring-graphql-version}/api +:spring-framework-ref-docs: https://docs.spring.io/spring-framework/docs/current/reference/html :spring-boot-version: current :spring-boot-ref-docs: https://docs.spring.io/spring-boot/docs/{spring-boot-version}/reference/html \ No newline at end of file diff --git a/spring-graphql-docs/src/docs/asciidoc/boot-starter.adoc b/spring-graphql-docs/src/docs/asciidoc/boot-starter.adoc index aa00db35..55a86a9c 100644 --- a/spring-graphql-docs/src/docs/asciidoc/boot-starter.adoc +++ b/spring-graphql-docs/src/docs/asciidoc/boot-starter.adoc @@ -232,6 +232,29 @@ spring.graphql.graphiql.path=/graphiql ---- +[[boot-graphql-cors]] +== CORS configuration + +Spring web frameworks all support CORS (Cross-Origin Resource Sharing), which is a critical part +of your web configuration if your GraphQL API is meant to be accessed by browsers using different domains. + +You can configure CORS support with properties: + +[source,properties,indent=0,subs="verbatim"] +---- +spring.graphql.cors.allowed-origins=https://example.org # Comma-separated list of origins to allow. '*' allows all origins. +spring.graphql.cors.allowed-origin-patterns= # Comma-separated list of origin patterns like 'https://*.example.com' to allow. +spring.graphql.cors.allowed-methods=GET,POST # Comma-separated list of methods to allow. '*' allows all methods. +spring.graphql.cors.allowed-headers= # Comma-separated list of headers to allow in a request. '*' allows all headers. +spring.graphql.cors.exposed-headers= # Comma-separated list of headers to include in a response. +spring.graphql.cors.allow-credentials= # Whether credentials are supported. When not set, credentials are not supported. +spring.graphql.cors.max-age=1800s # How long the response from a pre-flight request can be cached by clients. +---- + +TIP: For more information about the properties and their meaning, check out the {javadoc}/org/springframework/graphql/boot/GraphQlCorsProperties.html[GraphQlCorsProperties Javadoc]. + +You can also learn more about CORS and Spring support in {spring-framework-ref-docs}/web.html#mvc-cors[Spring MVC] and +{spring-framework-ref-docs}/web-reactive.html#webflux-cors[Spring WebFlux]. [[boot-graphql-metrics]] == Metrics