Spring Web 6.1.4 · org.springframework.web.bind.annotation.CrossOrigin

Annotation for permitting cross-origin requests on specific handler classes and/or handler methods. Processed if an appropriate HandlerMapping is configured.

Both Spring Web MVC and Spring WebFlux support this annotation through the RequestMappingHandlerMapping in their respective modules. The values from each type and method level pair of annotations are added to a CorsConfiguration and then default values are applied via CorsConfiguration#applyPermitDefaultValues().

The rules for combining global and local configuration are generally additive -- e.g. all global and all local origins. For those attributes where only a single value can be accepted such as allowCredentials and maxAge, the local overrides the global value. See CorsConfiguration#combine(CorsConfiguration) for more details.

Method Summary

Modifier and Type	Method and Description
public String	allowCredentials() Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint.
public String[]	allowedHeaders() The list of request headers that are permitted in actual requests, possibly `"*"` to allow all headers.
public String	allowPrivateNetwork() Whether private network access is supported.
public String[]	exposedHeaders() The List of response headers that the user-agent will allow the client to access on an actual response, possibly `"*"` to expose all headers.
public long	maxAge() The maximum age (in seconds) of the cache duration for preflight responses.
public RequestMethod[]	methods() The list of supported HTTP request methods.
public String[]	originPatterns() Alternative to `origins` that supports more flexible origin patterns.
public String[]	origins() A list of origins for which cross-origin requests are allowed.
public String[]	value() Alias for `origins`.

Inherited from java.lang.annotation.Annotation:: annotationType equals hashCode toString

Method Detail

allowCredentials back to summary

allowCredentials	back to summary
public String allowCredentials() Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint. Please, see `CorsConfiguration#setAllowCredentials(Boolean)` for details. Note Be aware that this option establishes a high level of trust with the configured domains and also increases the surface attack of the web application by exposing sensitive user-specific information such as cookies and CSRF tokens. By default this is not set in which case the `Access-Control-Allow-Credentials` header is also not set and credentials are therefore not allowed.

public String allowCredentials()

Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint. Please, see CorsConfiguration#setAllowCredentials(Boolean) for details.

Note

Be aware that this option establishes a high level of trust with the configured domains and also increases the surface attack of the web application by exposing sensitive user-specific information such as cookies and CSRF tokens.

By default this is not set in which case the Access-Control-Allow-Credentials header is also not set and credentials are therefore not allowed.

allowedHeaders back to summary

allowedHeaders	back to summary
public String[] allowedHeaders() The list of request headers that are permitted in actual requests, possibly `"*"` to allow all headers. Please, see `CorsConfiguration#setAllowedHeaders(List)` for details. By default all requested headers are allowed.

public String[] allowedHeaders()

The list of request headers that are permitted in actual requests, possibly "*" to allow all headers. Please, see CorsConfiguration#setAllowedHeaders(List) for details.

By default all requested headers are allowed.

allowPrivateNetwork back to summary

allowPrivateNetwork	back to summary
public String allowPrivateNetwork() Whether private network access is supported. Please, see `CorsConfiguration#setAllowPrivateNetwork(Boolean)` for details. By default this is not set (i.e. private network access is not supported). Since 5.3.32

public String allowPrivateNetwork()

Whether private network access is supported. Please, see CorsConfiguration#setAllowPrivateNetwork(Boolean) for details.

By default this is not set (i.e. private network access is not supported).

Since: 5.3.32

exposedHeaders back to summary

exposedHeaders	back to summary
public String[] exposedHeaders() The List of response headers that the user-agent will allow the client to access on an actual response, possibly `"*"` to expose all headers. Please, see `CorsConfiguration#setExposedHeaders(List)` for details. By default no headers are listed as exposed.

public String[] exposedHeaders()

The List of response headers that the user-agent will allow the client to access on an actual response, possibly "*" to expose all headers. Please, see CorsConfiguration#setExposedHeaders(List) for details.

By default no headers are listed as exposed.

maxAge back to summary

maxAge	back to summary
public long maxAge() The maximum age (in seconds) of the cache duration for preflight responses. This property controls the value of the `Access-Control-Max-Age` response header of preflight requests. Setting this to a reasonable value can reduce the number of preflight request/response interactions required by the browser. A negative value means undefined. By default this is set to `1800` seconds (30 minutes).

public long maxAge()

The maximum age (in seconds) of the cache duration for preflight responses.

This property controls the value of the Access-Control-Max-Age response header of preflight requests.

Setting this to a reasonable value can reduce the number of preflight request/response interactions required by the browser. A negative value means undefined.

By default this is set to 1800 seconds (30 minutes).

methods back to summary

methods	back to summary
public RequestMethod[] methods() The list of supported HTTP request methods. Please, see `CorsConfiguration#setAllowedMethods(List)` for details. By default the supported methods are the same as the ones to which a controller method is mapped.

public RequestMethod[] methods()

The list of supported HTTP request methods. Please, see CorsConfiguration#setAllowedMethods(List) for details.

By default the supported methods are the same as the ones to which a controller method is mapped.

originPatterns back to summary

originPatterns	back to summary
public String[] originPatterns() Alternative to `origins` that supports more flexible origin patterns. Please, see `CorsConfiguration#setAllowedOriginPatterns(List)` for details. By default this is not set. Since 5.3

public String[] originPatterns()

Alternative to origins that supports more flexible origin patterns. Please, see CorsConfiguration#setAllowedOriginPatterns(List) for details.

By default this is not set.

Since: 5.3

origins back to summary

origins	back to summary
public String[] origins() A list of origins for which cross-origin requests are allowed. Please, see `CorsConfiguration#setAllowedOrigins(List)` for details. By default all origins are allowed unless `originPatterns` is also set in which case `originPatterns` is used instead. Annotations @AliasFor:value

public String[] origins()

A list of origins for which cross-origin requests are allowed. Please, see CorsConfiguration#setAllowedOrigins(List) for details.

By default all origins are allowed unless originPatterns is also set in which case originPatterns is used instead.

Annotations

@AliasFor:value

value back to summary

value	back to summary
public String[] value() Alias for `origins`. Annotations @AliasFor:origins

public String[] value()

Alias for origins.

Annotations

@AliasFor:origins

public @Interface CrossOrigin

Method Summary

Method Detail