Spring/spring-integration
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

INT-4039: Add Allowed Origins to WebSockets

Browse Source 
JIRA: https://jira.spring.io/browse/INT-4039

Also add `suppressCors` for the `SockJsServiceOptions`

Polishing according PR comments
This commit is contained in:
Artem Bilan
2016-05-25 18:55:59 -04:00
committed by Gary Russell
parent d414383eac
commit f5488efcaa
8 changed files with 168 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
spring-integration-websocket/src/main/resources/org/springframework/integration/websocket/config/spring-integration-websocket-4.3.xsd
View File

@@ -248,6 +248,15 @@
</xsd:documentation>
</xsd:annotation>
</xsd:attribute>
<xsd:attribute name="suppress-cors" type="xsd:string" default="false">
<xsd:annotation>
<xsd:documentation>
This option can be used to disable automatic addition
of CORS headers for SockJS requests.
The default value is 'false'.
</xsd:documentation>
</xsd:annotation>
</xsd:attribute>
</xsd:complexType>
</xsd:element>
</xsd:sequence>
@@ -311,6 +320,24 @@
<xsd:union memberTypes="xsd:int xsd:string"/>
</xsd:simpleType>
</xsd:attribute>
<xsd:attribute name="allowed-origins" type="xsd:string">
<xsd:annotation>
<xsd:documentation>
Configure allowed Origin header values. Multiple origins may be specified
as a comma-separated list.
This check is mostly designed for browser clients. There is noting preventing other
types of client to modify the Origin header value.
When SockJS is enabled and allowed origins are restricted, transport types that do not
use Origin headers for cross origin requests (jsonp-polling, iframe-xhr-polling,
iframe-eventsource and iframe-htmlfile) are disabled. As a consequence, IE6/IE7 are not
supported and IE8/IE9 will only be supported without cookies.
By default, all origins are allowed.
</xsd:documentation>
</xsd:annotation>
</xsd:attribute>
</xsd:complexType>
</xsd:element>