Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: Restrict automatic CORS configuration to UrlBasedCorsConfigurationSource

Browse Source 
- Update CORS configuration logic to automatically enable .cors() only if a UrlBasedCorsConfigurationSource bean is present.
- Modify applyCorsIfAvailable method to check for UrlBasedCorsConfigurationSource instances.
This commit is contained in:
baezzys
2024-07-21 21:53:57 +09:00
committed by Marcus Hert Da Coregio
parent 0190763a02
commit 3d4bcf1b44
3 changed files with 44 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/modules/ROOT/pages/servlet/integrations/cors.adoc
View File

@@ -6,7 +6,7 @@ CORS must be processed before Spring Security, because the pre-flight request do
If the request does not contain any cookies and Spring Security is first, the request determines that the user is not authenticated (since there are no cookies in the request) and rejects it.
The easiest way to ensure that CORS is handled first is to use the `CorsFilter`.
Users can integrate the `CorsFilter` with Spring Security by providing a `CorsConfigurationSource`.
Users can integrate the `CorsFilter` with Spring Security by providing a `CorsConfigurationSource`. Note that Spring Security will automatically configure CORS only if a `UrlBasedCorsConfigurationSource` instance is present.
For example, the following will integrate CORS support within Spring Security:
[tabs]