Top Description Fields Constructors Methods
org.springframework.web.cors.reactive

public Class DefaultCorsProcessor

extends Object
implements CorsProcessor
Class Inheritance
All Implemented Interfaces
org.springframework.web.cors.reactive.CorsProcessor
Imports
java.util.ArrayList, .List, org.apache.commons.logging.Log, .LogFactory, org.springframework.http.HttpHeaders, .HttpMethod, .HttpStatus, org.springframework.http.server.reactive.ServerHttpRequest, .ServerHttpResponse, org.springframework.lang.Nullable, org.springframework.util.CollectionUtils, org.springframework.web.cors.CorsConfiguration, org.springframework.web.server.ServerWebExchange
The default implementation of CorsProcessor, as defined by the CORS W3C recommendation.

Note that when the supplied CorsConfiguration is null, this implementation does not reject simple or actual requests outright but simply avoids adding CORS headers to the response. CORS processing is also skipped if the response already contains CORS headers.

Authors
Sebastien Deleuze, Rossen Stoyanchev
Since
5.0

Field Summary

Modifier and TypeField and Description
pack-priv static final String
ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK

The Access-Control-Allow-Private-Network response header field name.

pack-priv static final String
ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK

The Access-Control-Request-Private-Network request header field name.

private static final Log
logger

private static final List<String>
VARY_HEADERS

Constructor Summary

AccessConstructor and Description
public
DefaultCorsProcessor()

Method Summary

Modifier and TypeMethod and Description
protected List<String>
checkHeaders(CorsConfiguration config, List<String> requestHeaders)

Check the headers and determine the headers for the response of a pre-flight request.

protected List<HttpMethod>
checkMethods(CorsConfiguration config, HttpMethod requestMethod)

Check the HTTP method and determine the methods for the response of a pre-flight request.

protected String
checkOrigin(CorsConfiguration config, String requestOrigin)

Check the origin and determine the origin for the response.

private List<String>
getHeadersToUse(ServerHttpRequest request, boolean isPreFlight)

private HttpMethod
getMethodToUse(ServerHttpRequest request, boolean isPreFlight)

protected boolean
handleInternal(ServerWebExchange exchange, CorsConfiguration config, boolean preFlightRequest)

Handle the given request.

public boolean
process(CorsConfiguration
the CORS configuration to use; possibly null in which case pre-flight requests are rejected, but all others allowed.
config, ServerWebExchange
the current exchange
exchange)

Implements org.springframework.web.cors.reactive.CorsProcessor.process.

Process a request using the given CorsConfiguration.

protected void
rejectRequest(ServerHttpResponse response)

Invoked when one of the CORS checks failed.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ACCESS_CONTROL_ALLOW_PRIVATE_NETWORKback to summary
pack-priv static final String ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK

The Access-Control-Allow-Private-Network response header field name.

See Also
Private Network Access specification
ACCESS_CONTROL_REQUEST_PRIVATE_NETWORKback to summary
pack-priv static final String ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK

The Access-Control-Request-Private-Network request header field name.

See Also
Private Network Access specification
loggerback to summary
private static final Log logger
VARY_HEADERSback to summary
private static final List<String> VARY_HEADERS

Constructor Detail

DefaultCorsProcessorback to summary
public DefaultCorsProcessor()

Method Detail

checkHeadersback to summary
protected List<String> checkHeaders(CorsConfiguration config, List<String> requestHeaders)

Check the headers and determine the headers for the response of a pre-flight request. The default implementation simply delegates to CorsConfiguration#checkHeaders(List).

Annotations
@Nullable
checkMethodsback to summary
protected List<HttpMethod> checkMethods(CorsConfiguration config, HttpMethod requestMethod)

Check the HTTP method and determine the methods for the response of a pre-flight request. The default implementation simply delegates to CorsConfiguration#checkHttpMethod(HttpMethod).

Annotations
@Nullable
checkOriginback to summary
protected String checkOrigin(CorsConfiguration config, String requestOrigin)

Check the origin and determine the origin for the response. The default implementation simply delegates to CorsConfiguration#checkOrigin(String).

Annotations
@Nullable
getHeadersToUseback to summary
private List<String> getHeadersToUse(ServerHttpRequest request, boolean isPreFlight)
getMethodToUseback to summary
private HttpMethod getMethodToUse(ServerHttpRequest request, boolean isPreFlight)
Annotations
@Nullable
handleInternalback to summary
protected boolean handleInternal(ServerWebExchange exchange, CorsConfiguration config, boolean preFlightRequest)

Handle the given request.

processback to summary
public boolean process(CorsConfiguration config, ServerWebExchange exchange)

Implements org.springframework.web.cors.reactive.CorsProcessor.process.

Doc from org.springframework.web.cors.reactive.CorsProcessor.process.

Process a request using the given CorsConfiguration.

Parameters
config:CorsConfiguration

the CORS configuration to use; possibly null in which case pre-flight requests are rejected, but all others allowed.

exchange:ServerWebExchange

the current exchange

Returns:boolean

false if the request was rejected, true otherwise

Annotations
@Override
rejectRequestback to summary
protected void rejectRequest(ServerHttpResponse response)

Invoked when one of the CORS checks failed.