Core :: Server 12.0.6 · org.eclipse.jetty.server.handler.CrossOriginHandler

Modifier and Type	Field and Description
private static final PreEncodedHttpField	ACCESS_CONTROL_ALLOW_CREDENTIALS_TRUE
private PreEncodedHttpField	accessControlAllowHeadersField
private PreEncodedHttpField	accessControlAllowMethodsField
private PreEncodedHttpField	accessControlExposeHeadersField
private PreEncodedHttpField	accessControlMaxAge
private boolean	allowCredentials
private Set<String>	allowedHeaders
private Set<String>	allowedMethods
private final Set<Pattern>	allowedOriginPatterns
private Set<String>	allowedOrigins
private final Set<Pattern>	allowedTimingOriginPatterns
private Set<String>	allowedTimingOrigins
private boolean	anyOriginAllowed
private boolean	anyTimingOriginAllowed
private boolean	deliverNonAllowedOrigin
private boolean	deliverNonAllowedOriginWebSocketUpgrade
private boolean	deliverPreflight
private Set<String>	exposedHeaders
private static final Logger	LOG Hides org.eclipse.jetty.server.Handler.Abstract.LOG.
private Duration	preflightMaxAge
private static final PreEncodedHttpField	VARY_ORIGIN

Access	Constructor and Description
public	CrossOriginHandler()

Method Summary

Modifier and Type	Method and Description
protected void	doStart() Overrides org.eclipse.jetty.server.Handler.Abstract.doStart. Starts the managed lifecycle beans in the order they were added.
public Set<String>	Returns: the immutable set of allowed headers in a cross-origin request getAllowedHeaders()
public Set<String>	Returns: the immutable set of allowed methods in a cross-origin request getAllowedMethods()
public Set<String>	Returns: the immutable set of allowed origin regex strings in a cross-origin request getAllowedOriginPatterns()
public Set<String>	Returns: the immutable set of allowed timing origin regex strings in a cross-origin request getAllowedTimingOriginPatterns()
public Set<String>	Returns: the immutable set of headers exposed in a cross-origin response getExposedHeaders()
public Duration	Returns: how long the preflight results can be cached by browsers getPreflightMaxAge()
public boolean	handle(Request the HTTP request to handle request, Response the HTTP response to handle response, Callback the callback to complete when the handling is complete callback) Overrides org.eclipse.jetty.server.Handler.Wrapper.handle. Implements org.eclipse.jetty.server.Request.Handler.handle. Invoked to handle the passed HTTP request and response.
private void	handlePreflightResponse(String origins, Response response)
private void	handleSimpleResponse(String origin, Response response)
public boolean	Returns: whether the cross server allows cross-origin requests to include credentials isAllowCredentials()
public boolean	Returns: whether requests whose origin is not allowed are delivered to the child Handler isDeliverNonAllowedOriginRequests()
public boolean	Returns: whether WebSocket upgrade requests whose origin is not allowed are delivered to the child Handler isDeliverNonAllowedOriginWebSocketUpgradeRequests()
public boolean	Returns: whether preflight requests are delivered to the child Handler isDeliverPreflightRequests()
private boolean	isPreflight(Request request)
private boolean	isWebSocketUpgrade(Request request)
private boolean	originMatches(String origins)
private boolean	originMatches(String origins, Set<Pattern> allowedOriginPatterns)
private void	resolveAllowedOrigins()
private void	resolveAllowedTimingOrigins()
public void	setAllowCredentials(boolean whether the cross server allows cross-origin requests to include credentials allow) Sets whether the cross server allows cross-origin requests to include credentials such as cookies or authentication headers.
public void	setAllowedHeaders(Set<String> the set of allowed headers in a cross-origin request headers) Sets the set of allowed headers in a cross-origin request.
public void	setAllowedMethods(Set<String> the set of allowed methods in a cross-origin request methods) Sets the set of allowed methods in a cross-origin request.
public void	setAllowedOriginPatterns(Set<String> the set of allowed origin regex strings in a cross-origin request origins) Sets the set of allowed origin regex strings in a cross-origin request.
public void	setAllowedTimingOriginPatterns(Set<String> the set of allowed timing origin regex strings in a cross-origin request origins) Sets the set of allowed timing origin regex strings in a cross-origin request.
public void	setDeliverNonAllowedOriginRequests(boolean whether requests whose origin is not allowed are delivered to the child Handler deliverNonAllowedOrigin) Sets whether requests whose origin is not allowed are delivered to the child Handler.
public void	setDeliverNonAllowedOriginWebSocketUpgradeRequests(boolean whether WebSocket upgrade requests whose origin is not allowed are delivered to the child Handler deliverNonAllowedOriginWebSocketUpgrade) Sets whether WebSocket upgrade requests whose origin is not allowed are delivered to the child Handler.
public void	setDeliverPreflightRequests(boolean whether preflight requests are delivered to the child Handler deliver) Sets whether preflight requests are delivered to the child `Handler`.
public void	setExposedHeaders(Set<String> the set of headers exposed in a cross-origin response headers) Sets the set of headers exposed in a cross-origin response.
public void	setPreflightMaxAge(Duration how long the preflight results can be cached by browsers duration)
private void	throwIfStarted()
private boolean	timingOriginMatches(String origins)

Inherited from org.eclipse.jetty.server.Handler.Wrapper:: getHandler getInvocationType setHandler

ACCESS_CONTROL_ALLOW_CREDENTIALS_TRUE	back to summary
private static final PreEncodedHttpField ACCESS_CONTROL_ALLOW_CREDENTIALS_TRUE

accessControlAllowHeadersField	back to summary
private PreEncodedHttpField accessControlAllowHeadersField

accessControlAllowMethodsField	back to summary
private PreEncodedHttpField accessControlAllowMethodsField

accessControlExposeHeadersField	back to summary
private PreEncodedHttpField accessControlExposeHeadersField

accessControlMaxAge	back to summary
private PreEncodedHttpField accessControlMaxAge

allowCredentials	back to summary
private boolean allowCredentials

allowedHeaders	back to summary
private Set<String> allowedHeaders

allowedMethods	back to summary
private Set<String> allowedMethods

allowedOriginPatterns	back to summary
private final Set<Pattern> allowedOriginPatterns

allowedOrigins	back to summary
private Set<String> allowedOrigins

allowedTimingOriginPatterns	back to summary
private final Set<Pattern> allowedTimingOriginPatterns

allowedTimingOrigins	back to summary
private Set<String> allowedTimingOrigins

anyOriginAllowed	back to summary
private boolean anyOriginAllowed

anyTimingOriginAllowed	back to summary
private boolean anyTimingOriginAllowed

deliverNonAllowedOrigin	back to summary
private boolean deliverNonAllowedOrigin

deliverNonAllowedOriginWebSocketUpgrade	back to summary
private boolean deliverNonAllowedOriginWebSocketUpgrade

deliverPreflight	back to summary
private boolean deliverPreflight

exposedHeaders	back to summary
private Set<String> exposedHeaders

LOG	back to summary
private static final Logger LOG Hides org.eclipse.jetty.server.Handler.Abstract.LOG.

preflightMaxAge	back to summary
private Duration preflightMaxAge

VARY_ORIGIN	back to summary
private static final PreEncodedHttpField VARY_ORIGIN

CrossOriginHandler	back to summary
public CrossOriginHandler()

Method Detail

doStart	back to summary
protected void doStart() throws Exception Overrides org.eclipse.jetty.server.Handler.Abstract.doStart. Doc from org.eclipse.jetty.util.component.ContainerLifeCycle.doStart. Starts the managed lifecycle beans in the order they were added. Annotations @Override Exceptions Exception: Doc from org.eclipse.jetty.util.component.AbstractLifeCycle.doStart. If there was a problem starting. Will cause a transition to FAILED state

doStart

back to summary

protected void doStart() throws Exception

Overrides org.eclipse.jetty.server.Handler.Abstract.doStart.

Doc from org.eclipse.jetty.util.component.ContainerLifeCycle.doStart.

Starts the managed lifecycle beans in the order they were added.

Annotations

@Override

Exceptions

Exception:

Doc from org.eclipse.jetty.util.component.AbstractLifeCycle.doStart.

If there was a problem starting. Will cause a transition to FAILED state

getAllowedHeaders	back to summary
public Set<String> getAllowedHeaders() Returns:Set<String> the immutable set of allowed headers in a cross-origin request Annotations @ManagedAttribute:The set of allowed headers in a cross-origin request

getAllowedMethods	back to summary
public Set<String> getAllowedMethods() Returns:Set<String> the immutable set of allowed methods in a cross-origin request Annotations @ManagedAttribute:The set of allowed methods in a cross-origin request

getAllowedOriginPatterns	back to summary
public Set<String> getAllowedOriginPatterns() Returns:Set<String> the immutable set of allowed origin regex strings in a cross-origin request Annotations @ManagedAttribute:The set of allowed origin regex strings in a cross-origin request

getAllowedTimingOriginPatterns	back to summary
public Set<String> getAllowedTimingOriginPatterns() Returns:Set<String> the immutable set of allowed timing origin regex strings in a cross-origin request Annotations @ManagedAttribute:The set of allowed timing origin regex strings in a cross-origin request

getExposedHeaders	back to summary
public Set<String> getExposedHeaders() Returns:Set<String> the immutable set of headers exposed in a cross-origin response Annotations @ManagedAttribute:The set of headers exposed in a cross-origin response

getPreflightMaxAge	back to summary
public Duration getPreflightMaxAge() Returns:Duration how long the preflight results can be cached by browsers Annotations @ManagedAttribute:How long the preflight results can be cached by browsers

handle back to summary

handle	back to summary
public boolean handle(Request request, Response response, Callback callback) throws Exception Overrides org.eclipse.jetty.server.Handler.Wrapper.handle. Implements org.eclipse.jetty.server.Request.Handler.handle. Doc from org.eclipse.jetty.server.Request.Handler.handle. Invoked to handle the passed HTTP request and response. The request is accepted by returning true, then handling must be concluded by completing the passed callback. The handling may be asynchronous, i.e. this method may return true and complete the given callback later, possibly from a different thread. If this method returns false, then the callback must not be invoked and any mutation on the response reversed. Exceptions thrown by this method may be subsequently handled by an error `Request.Handler`, if present, otherwise a default HTTP 500 error is generated and the callback completed while writing the error response. The simplest implementation is: public boolean handle(Request request, Response response, Callback callback) { callback.succeeded(); return true; } A HelloWorld implementation is: public boolean handle(Request request, Response response, Callback callback) { response.write(true, ByteBuffer.wrap("Hello World\n".getBytes(StandardCharsets.UTF_8)), callback); return true; } Parameters request:Request the HTTP request to handle response:Response the HTTP response to handle callback:Callback the callback to complete when the handling is complete Returns:boolean True if and only if the request will be handled, a response generated and the callback eventually called. This may occur within the scope of the call to this method, or asynchronously some time later. If false is returned, then this method must not generate a response, nor complete the callback. Annotations @Override Exceptions Exception: if there is a failure during the handling. Catchers cannot assume that the callback will be called and thus should attempt to complete the request as if a false had been returned.

public boolean handle(Request request, Response response, Callback callback) throws Exception

Overrides org.eclipse.jetty.server.Handler.Wrapper.handle.

Implements org.eclipse.jetty.server.Request.Handler.handle.

Doc from org.eclipse.jetty.server.Request.Handler.handle.

Invoked to handle the passed HTTP request and response.

The request is accepted by returning true, then handling must be concluded by completing the passed callback. The handling may be asynchronous, i.e. this method may return true and complete the given callback later, possibly from a different thread. If this method returns false, then the callback must not be invoked and any mutation on the response reversed.

Exceptions thrown by this method may be subsequently handled by an error Request.Handler, if present, otherwise a default HTTP 500 error is generated and the callback completed while writing the error response.

The simplest implementation is:

public boolean handle(Request request, Response response, Callback callback)
{
    callback.succeeded();
    return true;
}

A HelloWorld implementation is:

public boolean handle(Request request, Response response, Callback callback)
{
    response.write(true, ByteBuffer.wrap("Hello World\n".getBytes(StandardCharsets.UTF_8)), callback);
    return true;
}

Parameters

request:Request: the HTTP request to handle
response:Response: the HTTP response to handle
callback:Callback: the callback to complete when the handling is complete

Returns:boolean

True if and only if the request will be handled, a response generated and the callback eventually called. This may occur within the scope of the call to this method, or asynchronously some time later. If false is returned, then this method must not generate a response, nor complete the callback.

Annotations

@Override

Exceptions

Exception:: if there is a failure during the handling. Catchers cannot assume that the callback will be called and thus should attempt to complete the request as if a false had been returned.

handlePreflightResponse	back to summary
private void handlePreflightResponse(String origins, Response response)

handleSimpleResponse	back to summary
private void handleSimpleResponse(String origin, Response response)

isAllowCredentials	back to summary
public boolean isAllowCredentials() Returns:boolean whether the cross server allows cross-origin requests to include credentials Annotations @ManagedAttribute:Whether the server allows cross-origin requests to include credentials (cookies, authentication headers, etc.)

isDeliverNonAllowedOriginRequests	back to summary
public boolean isDeliverNonAllowedOriginRequests() Returns:boolean whether requests whose origin is not allowed are delivered to the child Handler Annotations @ManagedAttribute:whether requests whose origin is not allowed are delivered to the child Handler

isDeliverNonAllowedOriginWebSocketUpgradeRequests	back to summary
public boolean isDeliverNonAllowedOriginWebSocketUpgradeRequests() Returns:boolean whether WebSocket upgrade requests whose origin is not allowed are delivered to the child Handler Annotations @ManagedAttribute:whether WebSocket upgrade requests whose origin is not allowed are delivered to the child Handler

isDeliverPreflightRequests	back to summary
public boolean isDeliverPreflightRequests() Returns:boolean whether preflight requests are delivered to the child Handler Annotations @ManagedAttribute:whether preflight requests are delivered to the child Handler

isPreflight	back to summary
private boolean isPreflight(Request request)

isWebSocketUpgrade	back to summary
private boolean isWebSocketUpgrade(Request request)

originMatches	back to summary
private boolean originMatches(String origins)

originMatches	back to summary
private boolean originMatches(String origins, Set<Pattern> allowedOriginPatterns)

resolveAllowedOrigins	back to summary
private void resolveAllowedOrigins()

resolveAllowedTimingOrigins	back to summary
private void resolveAllowedTimingOrigins()

setAllowCredentials back to summary

setAllowCredentials	back to summary
public void setAllowCredentials(boolean allow) Sets whether the cross server allows cross-origin requests to include credentials such as cookies or authentication headers. For example, when the cross server allows credentials to be included, cross-origin requests will contain cookies, otherwise they will not. The default is `true`. Parameters allow:boolean whether the cross server allows cross-origin requests to include credentials

public void setAllowCredentials(boolean allow)

Sets whether the cross server allows cross-origin requests to include credentials such as cookies or authentication headers.

For example, when the cross server allows credentials to be included, cross-origin requests will contain cookies, otherwise they will not.

The default is true.

Parameters

allow:boolean: whether the cross server allows cross-origin requests to include credentials

setAllowedHeaders back to summary

setAllowedHeaders	back to summary
public void setAllowedHeaders(Set<String> headers) Sets the set of allowed headers in a cross-origin request. The cross server receives a preflight request that specifies the headers of the cross-origin request, and the cross server replies to the preflight request with the set of allowed headers. Browsers are responsible to check whether the headers of the cross-origin request are allowed, and if they are not produce an error. The headers can be either the character `*` to indicate any header, or actual header names. Parameters headers:Set<String> the set of allowed headers in a cross-origin request

public void setAllowedHeaders(Set<String> headers)

Sets the set of allowed headers in a cross-origin request.

The cross server receives a preflight request that specifies the headers of the cross-origin request, and the cross server replies to the preflight request with the set of allowed headers. Browsers are responsible to check whether the headers of the cross-origin request are allowed, and if they are not produce an error.

The headers can be either the character * to indicate any header, or actual header names.

Parameters

headers:Set<String>: the set of allowed headers in a cross-origin request

setAllowedMethods	back to summary
public void setAllowedMethods(Set<String> methods) Sets the set of allowed methods in a cross-origin request. The cross server receives a preflight request that specifies the method of the cross-origin request, and the cross server replies to the preflight request with the set of allowed methods. Browsers are responsible to check whether the method of the cross-origin request is allowed, and if it is not produce an error. Parameters methods:Set<String> the set of allowed methods in a cross-origin request

setAllowedMethods

back to summary

public void setAllowedMethods(Set<String> methods)

Sets the set of allowed methods in a cross-origin request.

The cross server receives a preflight request that specifies the method of the cross-origin request, and the cross server replies to the preflight request with the set of allowed methods. Browsers are responsible to check whether the method of the cross-origin request is allowed, and if it is not produce an error.

Parameters

methods:Set<String>: the set of allowed methods in a cross-origin request

setAllowedOriginPatterns back to summary

setAllowedOriginPatterns	back to summary
public void setAllowedOriginPatterns(Set<String> origins) Sets the set of allowed origin regex strings in a cross-origin request. The cross server receives a preflight or a cross-origin request specifying the `HttpHeader#ORIGIN`, and replies with the same origin if allowed, otherwise the `HttpHeader#ACCESS_CONTROL_ALLOW_ORIGIN` is not added to the response (and the client should fail the cross-origin or preflight request). The origins are either the character ``, or regular expressions, so dot characters separating domain segments must be escaped: `crossOriginHandler.setAllowedOriginPatterns(Set.of("https://.\\.domain\\.com"));` The default value is `*`. Parameters origins:Set<String> the set of allowed origin regex strings in a cross-origin request

public void setAllowedOriginPatterns(Set<String> origins)

Sets the set of allowed origin regex strings in a cross-origin request.

The cross server receives a preflight or a cross-origin request specifying the HttpHeader#ORIGIN, and replies with the same origin if allowed, otherwise the HttpHeader#ACCESS_CONTROL_ALLOW_ORIGIN is not added to the response (and the client should fail the cross-origin or preflight request).

The origins are either the character *, or regular expressions, so dot characters separating domain segments must be escaped:

crossOriginHandler.setAllowedOriginPatterns(Set.of("https://.*\\.domain\\.com"));

The default value is *.

Parameters

origins:Set<String>: the set of allowed origin regex strings in a cross-origin request

setAllowedTimingOriginPatterns	back to summary
public void setAllowedTimingOriginPatterns(Set<String> origins) Sets the set of allowed timing origin regex strings in a cross-origin request. Parameters origins:Set<String> the set of allowed timing origin regex strings in a cross-origin request

setAllowedTimingOriginPatterns

back to summary

public void setAllowedTimingOriginPatterns(Set<String> origins)

Sets the set of allowed timing origin regex strings in a cross-origin request.

Parameters

origins:Set<String>: the set of allowed timing origin regex strings in a cross-origin request

setDeliverNonAllowedOriginRequests back to summary

public void setDeliverNonAllowedOriginRequests(boolean deliverNonAllowedOrigin)

Sets whether requests whose origin is not allowed are delivered to the child Handler.

Default value is true.

Parameters

deliverNonAllowedOrigin:boolean: whether requests whose origin is not allowed are delivered to the child Handler

setDeliverNonAllowedOriginWebSocketUpgradeRequests back to summary

public void setDeliverNonAllowedOriginWebSocketUpgradeRequests(boolean deliverNonAllowedOriginWebSocketUpgrade)

Sets whether WebSocket upgrade requests whose origin is not allowed are delivered to the child Handler.

Default value is false.

Parameters

deliverNonAllowedOriginWebSocketUpgrade:boolean: whether WebSocket upgrade requests whose origin is not allowed are delivered to the child Handler

setDeliverPreflightRequests back to summary

public void setDeliverPreflightRequests(boolean deliver)

Sets whether preflight requests are delivered to the child Handler.

Default value is false.

Parameters

deliver:boolean: whether preflight requests are delivered to the child Handler

setExposedHeaders

back to summary

public void setExposedHeaders(Set<String> headers)

Sets the set of headers exposed in a cross-origin response.

The cross server receives a cross-origin request and indicates which response headers are exposed to scripts running in the browser.

Parameters

headers:Set<String>: the set of headers exposed in a cross-origin response

setPreflightMaxAge	back to summary
public void setPreflightMaxAge(Duration duration) Parameters duration:Duration how long the preflight results can be cached by browsers

throwIfStarted	back to summary
private void throwIfStarted()

timingOriginMatches	back to summary
private boolean timingOriginMatches(String origins)

public Class CrossOriginHandler

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail