Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Extend CorsDsl with CorsConfigurationSource property

Browse Source 
Issue: gh-9314
This commit is contained in:
Ivan Pavlov
2021-01-08 21:47:59 +03:00
committed by Eleftheria Stein-Kousathana
parent 0201c31deb
commit f4d78d00ef
2 changed files with 40 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
config/src/main/kotlin/org/springframework/security/config/web/servlet/CorsDsl.kt
View File

@@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2020 the original author or authors. * Copyright 2002-2021 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@@ -18,15 +18,19 @@ package org.springframework.security.config.web.servlet
import org.springframework.security.config.annotation.web.builders.HttpSecurity import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configurers.CorsConfigurer import org.springframework.security.config.annotation.web.configurers.CorsConfigurer
import org.springframework.web.cors.CorsConfigurationSource
/** /**
* A Kotlin DSL to configure [HttpSecurity] CORS using idiomatic Kotlin code. * A Kotlin DSL to configure [HttpSecurity] CORS using idiomatic Kotlin code.
* *
* @author Eleftheria Stein * @author Eleftheria Stein
* @since 5.3 * @since 5.3
* @property configurationSource the [CorsConfigurationSource] to use.
*/ */
@SecurityMarker @SecurityMarker
class CorsDsl { class CorsDsl {
var configurationSource: CorsConfigurationSource? = null
private var disabled = false private var disabled = false
/** /**
@@ -38,6 +42,7 @@ class CorsDsl {
internal fun get(): (CorsConfigurer<HttpSecurity>) -> Unit { internal fun get(): (CorsConfigurer<HttpSecurity>) -> Unit {
return { cors -> return { cors ->
configurationSource?.also { cors.configurationSource(configurationSource) }
if (disabled) { if (disabled) {
cors.disable() cors.disable()
} }

37
config/src/test/kotlin/org/springframework/security/config/web/servlet/CorsDslTests.kt
View File

@@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2020 the original author or authors. * Copyright 2002-2021 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@@ -67,7 +67,7 @@ class CorsDslTests {
@Test @Test
fun `CORS when CORS configuration source bean then responds with CORS header`() { fun `CORS when CORS configuration source bean then responds with CORS header`() {
this.spring.register(CorsCrossOriginConfig::class.java).autowire() this.spring.register(CorsCrossOriginBeanConfig::class.java).autowire()
this.mockMvc.get("/") this.mockMvc.get("/")
{ {
@@ -79,7 +79,7 @@ class CorsDslTests {
@EnableWebMvc @EnableWebMvc
@EnableWebSecurity @EnableWebSecurity
open class CorsCrossOriginConfig : WebSecurityConfigurerAdapter() { open class CorsCrossOriginBeanConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) { override fun configure(http: HttpSecurity) {
http { http {
cors { } cors { }
@@ -135,4 +135,35 @@ class CorsDslTests {
return source return source
} }
} }
@Test
fun `CORS when CORS configuration source dsl then responds with CORS header`() {
this.spring.register(CorsCrossOriginBeanConfig::class.java).autowire()
this.mockMvc.get("/")
{
header(HttpHeaders.ORIGIN, "https://example.com")
}.andExpect {
header { exists("Access-Control-Allow-Origin") }
}
}
@EnableWebMvc
@EnableWebSecurity
open class CorsCrossOriginSourceConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
val source = UrlBasedCorsConfigurationSource()
val corsConfiguration = CorsConfiguration()
corsConfiguration.allowedOrigins = listOf("*")
corsConfiguration.allowedMethods = listOf(
RequestMethod.GET.name,
RequestMethod.POST.name)
source.registerCorsConfiguration("/**", corsConfiguration)
http {
cors {
configurationSource = source
}
}
}
}
} }