Top Description Fields Constructors Methods
org.springframework.web.cors

public Class DefaultCorsProcessor

extends Object
implements CorsProcessor
Class Inheritance
All Implemented Interfaces
org.springframework.web.cors.CorsProcessor
Imports
java.io.IOException, java.nio.charset.StandardCharsets, java.util.ArrayList, .Collection, .List, jakarta.servlet.http.HttpServletRequest, .HttpServletResponse, org.apache.commons.logging.Log, .LogFactory, org.springframework.http.HttpHeaders, .HttpMethod, .HttpStatus, org.springframework.http.server.ServerHttpRequest, .ServerHttpResponse, .ServletServerHttpRequest, .ServletServerHttpResponse, org.springframework.lang.Nullable, org.springframework.util.CollectionUtils
The default implementation of CorsProcessor, as defined by the CORS W3C recommendation.

Note that when the supplied CorsConfiguration is null, this implementation does not reject simple or actual requests outright but simply avoids adding CORS headers to the response. CORS processing is also skipped if the response already contains CORS headers.

Authors
Sebastien Deleuze, Rossen Stoyanchev
Since
4.2

Field Summary

Modifier and TypeField and Description
pack-priv static final String
ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK

The Access-Control-Allow-Private-Network response header field name.

pack-priv static final String
ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK

The Access-Control-Request-Private-Network request header field name.

private static final Log
logger

Constructor Summary

AccessConstructor and Description
public
DefaultCorsProcessor()

Method Summary

Modifier and TypeMethod and Description
protected List<String>
checkHeaders(CorsConfiguration config, List<String> requestHeaders)

Check the headers and determine the headers for the response of a pre-flight request.

protected List<HttpMethod>
checkMethods(CorsConfiguration config, HttpMethod requestMethod)

Check the HTTP method and determine the methods for the response of a pre-flight request.

protected String
checkOrigin(CorsConfiguration config, String requestOrigin)

Check the origin and determine the origin for the response.

private List<String>
getHeadersToUse(ServerHttpRequest request, boolean isPreFlight)

private HttpMethod
getMethodToUse(ServerHttpRequest request, boolean isPreFlight)

protected boolean
handleInternal(ServerHttpRequest request, ServerHttpResponse response, CorsConfiguration config, boolean preFlightRequest)

Handle the given request.

public boolean
processRequest(CorsConfiguration
the applicable CORS configuration (possibly null)
config, HttpServletRequest
the current request
request, HttpServletResponse
the current response
response)

Implements org.springframework.web.cors.CorsProcessor.processRequest.

Process a request given a CorsConfiguration.
protected void
rejectRequest(ServerHttpResponse response)

Invoked when one of the CORS checks failed.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ACCESS_CONTROL_ALLOW_PRIVATE_NETWORKback to summary
pack-priv static final String ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK

The Access-Control-Allow-Private-Network response header field name.

See Also
Private Network Access specification
ACCESS_CONTROL_REQUEST_PRIVATE_NETWORKback to summary
pack-priv static final String ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK

The Access-Control-Request-Private-Network request header field name.

See Also
Private Network Access specification
loggerback to summary
private static final Log logger

Constructor Detail

DefaultCorsProcessorback to summary
public DefaultCorsProcessor()

Method Detail

checkHeadersback to summary
protected List<String> checkHeaders(CorsConfiguration config, List<String> requestHeaders)

Check the headers and determine the headers for the response of a pre-flight request. The default implementation simply delegates to org.springframework.web.cors.CorsConfiguration#checkHeaders(List).

Annotations
@Nullable
checkMethodsback to summary
protected List<HttpMethod> checkMethods(CorsConfiguration config, HttpMethod requestMethod)

Check the HTTP method and determine the methods for the response of a pre-flight request. The default implementation simply delegates to org.springframework.web.cors.CorsConfiguration#checkHttpMethod(HttpMethod).

Annotations
@Nullable
checkOriginback to summary
protected String checkOrigin(CorsConfiguration config, String requestOrigin)

Check the origin and determine the origin for the response. The default implementation simply delegates to org.springframework.web.cors.CorsConfiguration#checkOrigin(String).

Annotations
@Nullable
getHeadersToUseback to summary
private List<String> getHeadersToUse(ServerHttpRequest request, boolean isPreFlight)
getMethodToUseback to summary
private HttpMethod getMethodToUse(ServerHttpRequest request, boolean isPreFlight)
Annotations
@Nullable
handleInternalback to summary
protected boolean handleInternal(ServerHttpRequest request, ServerHttpResponse response, CorsConfiguration config, boolean preFlightRequest) throws IOException

Handle the given request.

processRequestback to summary
public boolean processRequest(CorsConfiguration config, HttpServletRequest request, HttpServletResponse response) throws IOException

Implements org.springframework.web.cors.CorsProcessor.processRequest.

Doc from org.springframework.web.cors.CorsProcessor.processRequest.

Process a request given a CorsConfiguration.

Parameters
config:CorsConfiguration

the applicable CORS configuration (possibly null)

request:HttpServletRequest

the current request

response:HttpServletResponse

the current response

Returns:boolean

false if the request is rejected, true otherwise

Annotations
@Override
@SuppressWarnings:resource
rejectRequestback to summary
protected void rejectRequest(ServerHttpResponse response) throws IOException

Invoked when one of the CORS checks failed. The default implementation sets the response status to 403 and writes "Invalid CORS request" to the response.