INT-3714: Add HTTP CORS Support
JIRA: https://jira.spring.io/browse/INT-3714 Docs and change Reactor dependency to `RELEASE` AMQP -> `1.5.0.M1` and rebase Doc Polishing
This commit is contained in:
Artem Bilan
committed by
Gary Russell
Gary Russell
parent
5065a5a1d5
commit
580ecddcc0
@@ -0,0 +1,52 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<beans:beans xmlns:int-http="http://www.springframework.org/schema/integration/http"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns:beans="http://www.springframework.org/schema/beans"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans.xsd
|
||||
http://www.springframework.org/schema/integration/http
|
||||
http://www.springframework.org/schema/integration/http/spring-integration-http.xsd">
|
||||
|
||||
<int-http:inbound-channel-adapter path="/no" supported-methods="GET" channel="nullChannel"/>
|
||||
|
||||
<int-http:inbound-channel-adapter path="/no" supported-methods="POST" channel="nullChannel"/>
|
||||
|
||||
<int-http:inbound-channel-adapter path="/default" supported-methods="GET" channel="nullChannel">
|
||||
<int-http:cross-origin/>
|
||||
</int-http:inbound-channel-adapter>
|
||||
|
||||
<int-http:inbound-channel-adapter path="/default" supported-methods="GET" channel="nullChannel">
|
||||
<int-http:request-mapping params="q"/>
|
||||
<int-http:cross-origin/>
|
||||
</int-http:inbound-channel-adapter>
|
||||
|
||||
<int-http:inbound-channel-adapter path="/ambiguous-header" supported-methods="GET" channel="nullChannel">
|
||||
<int-http:request-mapping headers="header1=a, header2=foo"/>
|
||||
<int-http:cross-origin/>
|
||||
</int-http:inbound-channel-adapter>
|
||||
|
||||
<int-http:inbound-channel-adapter path="/ambiguous-header" supported-methods="GET" channel="nullChannel">
|
||||
<int-http:request-mapping headers="header1=b"/>
|
||||
<int-http:cross-origin/>
|
||||
</int-http:inbound-channel-adapter>
|
||||
|
||||
<int-http:inbound-channel-adapter path="/customized" supported-methods="GET,POST" channel="nullChannel">
|
||||
<int-http:cross-origin origin="http://site1.com,http://site2.com"
|
||||
allowed-headers="header1, header2"
|
||||
exposed-headers="header3, header4"
|
||||
method="DELETE"
|
||||
max-age="123"
|
||||
allow-credentials="false"/>
|
||||
</int-http:inbound-channel-adapter>
|
||||
|
||||
<int-http:inbound-gateway path="/ambiguous-produces" supported-methods="GET" request-channel="nullChannel">
|
||||
<int-http:request-mapping produces="application/xml"/>
|
||||
<int-http:cross-origin/>
|
||||
</int-http:inbound-gateway>
|
||||
|
||||
<int-http:inbound-gateway path="/ambiguous-produces" supported-methods="GET" request-channel="nullChannel">
|
||||
<int-http:request-mapping produces="application/json"/>
|
||||
<int-http:cross-origin/>
|
||||
</int-http:inbound-gateway>
|
||||
|
||||
</beans:beans>
|
||||
@@ -0,0 +1,190 @@
|
||||
/*
|
||||
* Copyright 2015 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.integration.http.inbound;
|
||||
|
||||
import static org.junit.Assert.assertArrayEquals;
|
||||
import static org.junit.Assert.assertEquals;
|
||||
import static org.junit.Assert.assertNotNull;
|
||||
import static org.junit.Assert.assertNull;
|
||||
import static org.junit.Assert.assertTrue;
|
||||
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.http.HttpHeaders;
|
||||
import org.springframework.integration.test.util.TestUtils;
|
||||
import org.springframework.mock.web.MockHttpServletRequest;
|
||||
import org.springframework.test.annotation.DirtiesContext;
|
||||
import org.springframework.test.context.ContextConfiguration;
|
||||
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
|
||||
import org.springframework.web.HttpRequestMethodNotSupportedException;
|
||||
import org.springframework.web.cors.CorsConfiguration;
|
||||
import org.springframework.web.servlet.HandlerExecutionChain;
|
||||
import org.springframework.web.servlet.HandlerInterceptor;
|
||||
|
||||
/**
|
||||
* @author Artem Bilan
|
||||
* @since 4.2
|
||||
*/
|
||||
@RunWith(SpringJUnit4ClassRunner.class)
|
||||
@ContextConfiguration
|
||||
@DirtiesContext
|
||||
public class CrossOriginTests {
|
||||
|
||||
@Autowired
|
||||
private IntegrationRequestMappingHandlerMapping handlerMapping;
|
||||
|
||||
private MockHttpServletRequest request;
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
this.request = new MockHttpServletRequest();
|
||||
this.request.setMethod("GET");
|
||||
this.request.addHeader(HttpHeaders.ORIGIN, "http://domain.com/");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void noEndpointWithoutOriginHeader() throws Exception {
|
||||
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/no");
|
||||
HandlerExecutionChain chain = this.handlerMapping.getHandler(request);
|
||||
CorsConfiguration config = getCorsConfiguration(chain, false);
|
||||
assertNull(config);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void noEndpointWithOriginHeader() throws Exception {
|
||||
this.request.setRequestURI("/no");
|
||||
HandlerExecutionChain chain = this.handlerMapping.getHandler(request);
|
||||
CorsConfiguration config = getCorsConfiguration(chain, false);
|
||||
assertNull(config);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void noEndpointPostWithOriginHeader() throws Exception {
|
||||
this.request.setMethod("POST");
|
||||
this.request.setRequestURI("/no");
|
||||
HandlerExecutionChain chain = this.handlerMapping.getHandler(this.request);
|
||||
CorsConfiguration config = getCorsConfiguration(chain, false);
|
||||
assertNull(config);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void defaultEndpointWithCrossOrigin() throws Exception {
|
||||
this.request.setRequestURI("/default");
|
||||
HandlerExecutionChain chain = this.handlerMapping.getHandler(this.request);
|
||||
CorsConfiguration config = getCorsConfiguration(chain, false);
|
||||
assertNotNull(config);
|
||||
assertArrayEquals(new String[]{"GET"}, config.getAllowedMethods().toArray());
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedOrigins().toArray());
|
||||
assertTrue(config.getAllowCredentials());
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedHeaders().toArray());
|
||||
assertNull(config.getExposedHeaders());
|
||||
assertEquals(new Long(1800), config.getMaxAge());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void customized() throws Exception {
|
||||
this.request.setRequestURI("/customized");
|
||||
HandlerExecutionChain chain = this.handlerMapping.getHandler(this.request);
|
||||
CorsConfiguration config = getCorsConfiguration(chain, false);
|
||||
assertNotNull(config);
|
||||
assertArrayEquals(new String[]{"DELETE"}, config.getAllowedMethods().toArray());
|
||||
assertArrayEquals(new String[]{"http://site1.com", "http://site2.com"}, config.getAllowedOrigins().toArray());
|
||||
assertArrayEquals(new String[]{"header1", "header2"}, config.getAllowedHeaders().toArray());
|
||||
assertArrayEquals(new String[]{"header3", "header4"}, config.getExposedHeaders().toArray());
|
||||
assertEquals(new Long(123), config.getMaxAge());
|
||||
assertEquals(false, config.getAllowCredentials());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void preFlightRequest() throws Exception {
|
||||
this.request.setMethod("OPTIONS");
|
||||
this.request.addHeader(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, "GET");
|
||||
this.request.setRequestURI("/default");
|
||||
HandlerExecutionChain chain = this.handlerMapping.getHandler(this.request);
|
||||
CorsConfiguration config = getCorsConfiguration(chain, true);
|
||||
assertNotNull(config);
|
||||
assertArrayEquals(new String[]{"GET"}, config.getAllowedMethods().toArray());
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedOrigins().toArray());
|
||||
assertTrue(config.getAllowCredentials());
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedHeaders().toArray());
|
||||
assertNull(config.getExposedHeaders());
|
||||
assertEquals(new Long(1800), config.getMaxAge());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void ambiguousHeaderPreFlightRequest() throws Exception {
|
||||
this.request.setMethod("OPTIONS");
|
||||
this.request.addHeader(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, "GET");
|
||||
this.request.addHeader(HttpHeaders.ACCESS_CONTROL_REQUEST_HEADERS, "header1");
|
||||
this.request.setRequestURI("/ambiguous-header");
|
||||
HandlerExecutionChain chain = this.handlerMapping.getHandler(this.request);
|
||||
CorsConfiguration config = getCorsConfiguration(chain, true);
|
||||
assertNotNull(config);
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedMethods().toArray());
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedOrigins().toArray());
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedHeaders().toArray());
|
||||
assertTrue(config.getAllowCredentials());
|
||||
assertNull(config.getExposedHeaders());
|
||||
assertNull(config.getMaxAge());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void ambiguousProducesPreFlightRequest() throws Exception {
|
||||
this.request.setMethod("OPTIONS");
|
||||
this.request.addHeader(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, "GET");
|
||||
this.request.setRequestURI("/ambiguous-produces");
|
||||
HandlerExecutionChain chain = this.handlerMapping.getHandler(this.request);
|
||||
CorsConfiguration config = getCorsConfiguration(chain, true);
|
||||
assertNotNull(config);
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedMethods().toArray());
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedOrigins().toArray());
|
||||
assertArrayEquals(new String[]{"*"}, config.getAllowedHeaders().toArray());
|
||||
assertTrue(config.getAllowCredentials());
|
||||
assertNull(config.getExposedHeaders());
|
||||
assertNull(config.getMaxAge());
|
||||
}
|
||||
|
||||
@Test(expected = HttpRequestMethodNotSupportedException.class)
|
||||
public void preFlightRequestWithoutRequestMethodHeader() throws Exception {
|
||||
MockHttpServletRequest request = new MockHttpServletRequest("OPTIONS", "/default");
|
||||
request.addHeader(HttpHeaders.ORIGIN, "http://domain2.com");
|
||||
this.handlerMapping.getHandler(request);
|
||||
}
|
||||
|
||||
private CorsConfiguration getCorsConfiguration(HandlerExecutionChain chain, boolean isPreFlightRequest) {
|
||||
if (isPreFlightRequest) {
|
||||
Object handler = chain.getHandler();
|
||||
assertTrue(handler.getClass().getSimpleName().equals("PreFlightHandler"));
|
||||
return TestUtils.getPropertyValue(handler, "config", CorsConfiguration.class);
|
||||
}
|
||||
else {
|
||||
HandlerInterceptor[] interceptors = chain.getInterceptors();
|
||||
if (interceptors != null) {
|
||||
for (HandlerInterceptor interceptor : interceptors) {
|
||||
if (interceptor.getClass().getSimpleName().equals("CorsInterceptor")) {
|
||||
return TestUtils.getPropertyValue(interceptor, "config", CorsConfiguration.class);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user