Spring/spring-graphql
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow CORS configuration using config properties

Browse Source 
Prior to this commit, a Spring GraphQL application would need to
implement `WebMvcConfigurer` or `WebFluxConfigurer` to register a
specific CORS configuration and map it to the GraphQL endpoint.

This commit adds new configuration properties under the
`spring.graphql.cors.*` namespace that helps configuring CORS for the
GraphQL endpoint.

Closes gh-26
This commit is contained in:
Brian Clozel
2021-09-21 20:20:22 +02:00
parent 543be8429f
commit 93c696f9bc
8 changed files with 325 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-graphql-docs/src/docs/asciidoc/attributes.adoc
View File

@@ -16,5 +16,7 @@
:github-issues: https://github.com/{github-repo}/issues/
:github-main-branch: https://github.com/{github-repo}/tree/main
:github-wiki: https://github.com/{github-repo}/wiki
:javadoc: https://docs.spring.io/spring-graphql/docs/{spring-graphql-version}/api
:spring-framework-ref-docs: https://docs.spring.io/spring-framework/docs/current/reference/html
:spring-boot-version: current
:spring-boot-ref-docs: https://docs.spring.io/spring-boot/docs/{spring-boot-version}/reference/html

23
spring-graphql-docs/src/docs/asciidoc/boot-starter.adoc
View File

@@ -232,6 +232,29 @@ spring.graphql.graphiql.path=/graphiql
----
[[boot-graphql-cors]]
== CORS configuration
Spring web frameworks all support CORS (Cross-Origin Resource Sharing), which is a critical part
of your web configuration if your GraphQL API is meant to be accessed by browsers using different domains.
You can configure CORS support with properties:
[source,properties,indent=0,subs="verbatim"]
----
spring.graphql.cors.allowed-origins=https://example.org # Comma-separated list of origins to allow. '*' allows all origins.
spring.graphql.cors.allowed-origin-patterns= # Comma-separated list of origin patterns like 'https://*.example.com' to allow.
spring.graphql.cors.allowed-methods=GET,POST # Comma-separated list of methods to allow. '*' allows all methods.
spring.graphql.cors.allowed-headers= # Comma-separated list of headers to allow in a request. '*' allows all headers.
spring.graphql.cors.exposed-headers= # Comma-separated list of headers to include in a response.
spring.graphql.cors.allow-credentials= # Whether credentials are supported. When not set, credentials are not supported.
spring.graphql.cors.max-age=1800s # How long the response from a pre-flight request can be cached by clients.
----
TIP: For more information about the properties and their meaning, check out the {javadoc}/org/springframework/graphql/boot/GraphQlCorsProperties.html[GraphQlCorsProperties Javadoc].
You can also learn more about CORS and Spring support in {spring-framework-ref-docs}/web.html#mvc-cors[Spring MVC] and
{spring-framework-ref-docs}/web-reactive.html#webflux-cors[Spring WebFlux].
[[boot-graphql-metrics]]
== Metrics