Top Description Fields Constructors Methods
org.springframework.web.cors

public Class UrlBasedCorsConfigurationSource

extends Object
implements CorsConfigurationSource
Class Inheritance
All Implemented Interfaces
org.springframework.web.cors.CorsConfigurationSource
Imports
java.util.Collections, .LinkedHashMap, .Map, jakarta.servlet.http.HttpServletRequest, org.springframework.http.server.PathContainer, org.springframework.lang.Nullable, org.springframework.util.AntPathMatcher, .Assert, .CollectionUtils, .PathMatcher, org.springframework.web.util.ServletRequestPathUtils, .UrlPathHelper, org.springframework.web.util.pattern.PathPattern, .PathPatternParser
CorsConfigurationSource that uses URL path patterns to select the CorsConfiguration for a request.

Pattern matching can be done with a PathMatcher or with pre-parsed PathPatterns. The syntax is largely the same with the latter being more tailored for web usage and more efficient. The choice depends on the presence of a resolved String lookupPath or a parsed RequestPath with a fallback on PathMatcher but the fallback can be disabled. For more details, please see setAllowInitLookupPath(boolean).

Authors
Sebastien Deleuze, Rossen Stoyanchev
Since
4.2
See Also
PathPattern, AntPathMatcher

Field Summary

Modifier and TypeField and Description
private boolean
allowInitLookupPath

private final Map<PathPattern, CorsConfiguration>
corsConfigurations

private static final PathMatcher
defaultPathMatcher

private String
lookupPathAttributeName

private PathMatcher
pathMatcher

private final PathPatternParser
patternParser

private UrlPathHelper
urlPathHelper

Constructor Summary

AccessConstructor and Description
public
UrlBasedCorsConfigurationSource()

Default constructor with PathPatternParser#defaultInstance.

public
UrlBasedCorsConfigurationSource(PathPatternParser
the parser to use
parser)

Constructor with a PathPatternParser to parse patterns with.

Method Summary

Modifier and TypeMethod and Description
public CorsConfiguration
getCorsConfiguration(HttpServletRequest request)

Implements org.springframework.web.cors.CorsConfigurationSource.getCorsConfiguration.

Return a CorsConfiguration based on the incoming request.

public Map<String, CorsConfiguration>
getCorsConfigurations()

Return all configured CORS mappings.

private void
initUrlPathHelper()

private boolean
match(Object path, boolean isPathContainer, PathPattern pattern)

public void
registerCorsConfiguration(String
the mapping pattern
pattern, CorsConfiguration
the CORS configuration to use for the pattern
config)

Variant of setCorsConfigurations(Map) to register one mapping at a time.

private Object
resolvePath(HttpServletRequest request)

public void
setAllowInitLookupPath(boolean
whether to disable lazy initialization and fail if not already resolved
allowInitLookupPath)

When enabled, if there is neither a esolved String lookupPath nor a parsed RequestPath then use the configured UrlPathHelper to resolve a String lookupPath.

public void
setAlwaysUseFullPath(boolean alwaysUseFullPath)
Deprecated as of 5.3 in favor of using setUrlPathHelper(UrlPathHelper), if at all.

Shortcut to the same property on the configured UrlPathHelper.

public void
setCorsConfigurations(Map<String, CorsConfiguration>
the mappings to use
corsConfigurations)

Set the CORS configuration mappings.

public void
setLookupPathAttributeName(String
the request attribute to check
name)
Deprecated as of 5.3 in favor of UrlPathHelper#PATH_ATTRIBUTE.

Configure the name of the attribute that holds the lookupPath extracted via UrlPathHelper#getLookupPathForRequest(HttpServletRequest).

public void
setPathMatcher(PathMatcher pathMatcher)

Configure a PathMatcher to use for pattern matching.

public void
setRemoveSemicolonContent(boolean removeSemicolonContent)
Deprecated as of 5.3 in favor of using setUrlPathHelper(UrlPathHelper), if at all.

Shortcut to the same property on the configured UrlPathHelper.

public void
setUrlDecode(boolean urlDecode)
Deprecated as of 5.3 in favor of using setUrlPathHelper(UrlPathHelper), if at all.

Shortcut to the same property on the configured UrlPathHelper.

public void
setUrlPathHelper(UrlPathHelper urlPathHelper)

Configure the UrlPathHelper to resolve the lookupPath.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

allowInitLookupPathback to summary
private boolean allowInitLookupPath
corsConfigurationsback to summary
private final Map<PathPattern, CorsConfiguration> corsConfigurations
defaultPathMatcherback to summary
private static final PathMatcher defaultPathMatcher
lookupPathAttributeNameback to summary
private String lookupPathAttributeName
Annotations
@Nullable
pathMatcherback to summary
private PathMatcher pathMatcher
patternParserback to summary
private final PathPatternParser patternParser
urlPathHelperback to summary
private UrlPathHelper urlPathHelper

Constructor Detail

UrlBasedCorsConfigurationSourceback to summary
public UrlBasedCorsConfigurationSource()

Default constructor with PathPatternParser#defaultInstance.

UrlBasedCorsConfigurationSourceback to summary
public UrlBasedCorsConfigurationSource(PathPatternParser parser)

Constructor with a PathPatternParser to parse patterns with.

Parameters
parser:PathPatternParser

the parser to use

Since
5.3

Method Detail

getCorsConfigurationback to summary
public CorsConfiguration getCorsConfiguration(HttpServletRequest request)

Implements org.springframework.web.cors.CorsConfigurationSource.getCorsConfiguration.

Doc from org.springframework.web.cors.CorsConfigurationSource.getCorsConfiguration.

Return a CorsConfiguration based on the incoming request.

Returns:CorsConfiguration

the associated CorsConfiguration, or null if none

Annotations
@Override
@Nullable
getCorsConfigurationsback to summary
public Map<String, CorsConfiguration> getCorsConfigurations()

Return all configured CORS mappings.

initUrlPathHelperback to summary
private void initUrlPathHelper()
matchback to summary
private boolean match(Object path, boolean isPathContainer, PathPattern pattern)
registerCorsConfigurationback to summary
public void registerCorsConfiguration(String pattern, CorsConfiguration config)

Variant of setCorsConfigurations(Map) to register one mapping at a time.

Parameters
pattern:String

the mapping pattern

config:CorsConfiguration

the CORS configuration to use for the pattern

See Also
PathPattern, AntPathMatcher
resolvePathback to summary
private Object resolvePath(HttpServletRequest request)
Annotations
@SuppressWarnings:deprecation
setAllowInitLookupPathback to summary
public void setAllowInitLookupPath(boolean allowInitLookupPath)

When enabled, if there is neither a esolved String lookupPath nor a parsed RequestPath then use the configured UrlPathHelper to resolve a String lookupPath. This in turn determines use of URL pattern matching with PathMatcher or with parsed PathPatterns.

In Spring MVC, either a resolved String lookupPath or a parsed RequestPath is always available within DispatcherServlet processing. However, in a Servlet Filter such as CorsFilter that may or may not be the case.

By default this is set to true in which case lazy lookupPath initialization is allowed. Set this to false when an application is using parsed PathPatterns in which case the RequestPath can be parsed earlier via ServletRequestPathFilter.

Parameters
allowInitLookupPath:boolean

whether to disable lazy initialization and fail if not already resolved

Since
5.3
setAlwaysUseFullPathback to summary
public void setAlwaysUseFullPath(boolean alwaysUseFullPath)

Deprecated

as of 5.3 in favor of using setUrlPathHelper(UrlPathHelper), if at all. For further details, please see setAllowInitLookupPath(boolean).

Shortcut to the same property on the configured UrlPathHelper.

Annotations
@Deprecated
setCorsConfigurationsback to summary
public void setCorsConfigurations(Map<String, CorsConfiguration> corsConfigurations)

Set the CORS configuration mappings.

For pattern syntax see AntPathMatcher and PathPattern as well as class-level Javadoc for details on which one may in use. Generally the syntax is largely the same with PathPattern more tailored for web usage.

Parameters
corsConfigurations:Map<String, CorsConfiguration>

the mappings to use

See Also
PathPattern, AntPathMatcher
setLookupPathAttributeNameback to summary
public void setLookupPathAttributeName(String name)

Deprecated

as of 5.3 in favor of UrlPathHelper#PATH_ATTRIBUTE.

Configure the name of the attribute that holds the lookupPath extracted via UrlPathHelper#getLookupPathForRequest(HttpServletRequest).

By default this is UrlPathHelper#PATH_ATTRIBUTE.

Parameters
name:String

the request attribute to check

Annotations
@Deprecated
Since
5.2
setPathMatcherback to summary
public void setPathMatcher(PathMatcher pathMatcher)

Configure a PathMatcher to use for pattern matching.

This is an advanced property that should be used only when a customized AntPathMatcher or a custom PathMatcher is required.

By default this is AntPathMatcher.

Note

Setting PathMatcher enforces use of String pattern matching even when a parsed RequestPath is available.

setRemoveSemicolonContentback to summary
public void setRemoveSemicolonContent(boolean removeSemicolonContent)

Deprecated

as of 5.3 in favor of using setUrlPathHelper(UrlPathHelper), if at all. For further details, please see setAllowInitLookupPath(boolean).

Shortcut to the same property on the configured UrlPathHelper.

Annotations
@Deprecated
setUrlDecodeback to summary
public void setUrlDecode(boolean urlDecode)

Deprecated

as of 5.3 in favor of using setUrlPathHelper(UrlPathHelper), if at all. For further details, please see setAllowInitLookupPath(boolean).

Shortcut to the same property on the configured UrlPathHelper.

Annotations
@Deprecated
setUrlPathHelperback to summary
public void setUrlPathHelper(UrlPathHelper urlPathHelper)

Configure the UrlPathHelper to resolve the lookupPath. This may not be necessary if the lookupPath is expected to be pre-resolved or if parsed PathPatterns are used instead. For further details on that, see setAllowInitLookupPath(boolean).

By default this is UrlPathHelper#defaultInstance.