Package org.springframework.web.cors
Class DefaultCorsProcessor
- java.lang.Object
- org.springframework.web.cors.DefaultCorsProcessor
- All Implemented Interfaces:
CorsProcessor
public class DefaultCorsProcessor extends Object implements CorsProcessor
The default implementation ofCorsProcessor
, as defined by the CORS W3C recommendation.Note that when input
CorsConfiguration
isnull
, this implementation does not reject simple or actual requests outright but simply avoid adding CORS headers to the response. CORS processing is also skipped if the response already contains CORS headers, or if the request is detected as a same-origin one.- Since:
- 4.2
- Author:
- Sebastien Deleuze, Rossen Stoyanchev
Constructor Summary
Constructors Constructor Description DefaultCorsProcessor()
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description protected List<String>
checkHeaders(CorsConfiguration config, List<String> requestHeaders)
Check the headers and determine the headers for the response of a pre-flight request.protected List<HttpMethod>
checkMethods(CorsConfiguration config, HttpMethod requestMethod)
Check the HTTP method and determine the methods for the response of a pre-flight request.protected String
checkOrigin(CorsConfiguration config, String requestOrigin)
Check the origin and determine the origin for the response.protected boolean
handleInternal(ServerHttpRequest request, ServerHttpResponse response, CorsConfiguration config, boolean preFlightRequest)
Handle the given request.boolean
processRequest(CorsConfiguration config, HttpServletRequest request, HttpServletResponse response)
Process a request given aCorsConfiguration
.protected void
rejectRequest(ServerHttpResponse response)
Invoked when one of the CORS checks failed.
Constructor Detail
DefaultCorsProcessor
public DefaultCorsProcessor()
Method Detail
processRequest
public boolean processRequest(CorsConfiguration config, HttpServletRequest request, HttpServletResponse response) throws IOException
Description copied from interface:CorsProcessor
Process a request given aCorsConfiguration
.- Specified by:
processRequest
in interfaceCorsProcessor
- Parameters:
config
- the applicable CORS configuration (possiblynull
)request
- the current requestresponse
- the current response- Returns:
false
if the request is rejected,true
otherwise- Throws:
IOException
rejectRequest
protected void rejectRequest(ServerHttpResponse response) throws IOException
Invoked when one of the CORS checks failed. The default implementation sets the response status to 403 and writes "Invalid CORS request" to the response.- Throws:
IOException
handleInternal
protected boolean handleInternal(ServerHttpRequest request, ServerHttpResponse response, CorsConfiguration config, boolean preFlightRequest) throws IOException
Handle the given request.- Throws:
IOException
checkOrigin
protected String checkOrigin(CorsConfiguration config, String requestOrigin)
Check the origin and determine the origin for the response. The default implementation simply delegates toCorsConfiguration.checkOrigin(String)
.
checkMethods
protected List<HttpMethod> checkMethods(CorsConfiguration config, HttpMethod requestMethod)
Check the HTTP method and determine the methods for the response of a pre-flight request. The default implementation simply delegates toCorsConfiguration.checkHttpMethod(HttpMethod)
.
checkHeaders
protected List<String> checkHeaders(CorsConfiguration config, List<String> requestHeaders)
Check the headers and determine the headers for the response of a pre-flight request. The default implementation simply delegates toCorsConfiguration.checkOrigin(String)
.