Spring Framework 6.1.4 · org.springframework.web.servlet.config.annotation.CorsRegistration

Modifier and Type	Field and Description
private CorsConfiguration	config
private final String	pathPattern

Access	Constructor and Description
public	CorsRegistration(String pathPattern)

Method Summary

Modifier and Type	Method and Description
public CorsRegistration	allowCredentials(boolean allowCredentials) Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint.
public CorsRegistration	allowedHeaders(String... headers) Set the list of headers that a pre-flight request can list as allowed for use during an actual request.
public CorsRegistration	allowedMethods(String... methods) Set the HTTP methods to allow, e.g. `"GET"`, `"POST"`, etc. The special value `"*"` allows all methods.
public CorsRegistration	allowedOriginPatterns(String... patterns) Alternative to `allowedOrigins(String...)` that supports more flexible patterns for specifying the origins for which cross-origin requests are allowed from a browser.
public CorsRegistration	allowedOrigins(String... origins) Set the origins for which cross-origin requests are allowed from a browser.
public CorsRegistration	allowPrivateNetwork(boolean allowPrivateNetwork) Whether private network access is supported.
public CorsRegistration	combine(CorsConfiguration the configuration to apply other) Apply the given `CorsConfiguration` to the one being configured via `CorsConfiguration#combine(CorsConfiguration)` which in turn has been initialized with `CorsConfiguration#applyPermitDefaultValues()`.
public CorsRegistration	exposedHeaders(String... headers) Set the list of response headers that an actual response might have and can be exposed.
protected CorsConfiguration	getCorsConfiguration()
protected String	getPathPattern()
public CorsRegistration	maxAge(long maxAge) Configure how long in seconds the response from a pre-flight request can be cached by clients.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

config	back to summary
private CorsConfiguration config

pathPattern	back to summary
private final String pathPattern

CorsRegistration	back to summary
public CorsRegistration(String pathPattern)

Method Detail

allowCredentials back to summary

allowCredentials	back to summary
public CorsRegistration allowCredentials(boolean allowCredentials) Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint. The configured value is set on the `Access-Control-Allow-Credentials` response header of preflight requests. Note Be aware that this option establishes a high level of trust with the configured domains and also increases the surface attack of the web application by exposing sensitive user-specific information such as cookies and CSRF tokens. By default this is not set in which case the `Access-Control-Allow-Credentials` header is also not set and credentials are therefore not allowed.

public CorsRegistration allowCredentials(boolean allowCredentials)

Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint. The configured value is set on the Access-Control-Allow-Credentials response header of preflight requests.

Note

Be aware that this option establishes a high level of trust with the configured domains and also increases the surface attack of the web application by exposing sensitive user-specific information such as cookies and CSRF tokens.

By default this is not set in which case the Access-Control-Allow-Credentials header is also not set and credentials are therefore not allowed.

allowedHeaders back to summary

allowedHeaders	back to summary
public CorsRegistration allowedHeaders(String... headers) Set the list of headers that a pre-flight request can list as allowed for use during an actual request. The special value `"*"` may be used to allow all headers. Please, see `CorsConfiguration#setAllowedHeaders(List)` for details. By default all headers are allowed.

public CorsRegistration allowedHeaders(String... headers)

Set the list of headers that a pre-flight request can list as allowed for use during an actual request. The special value "*" may be used to allow all headers.

Please, see CorsConfiguration#setAllowedHeaders(List) for details.

By default all headers are allowed.

allowedMethods back to summary

allowedMethods	back to summary
public CorsRegistration allowedMethods(String... methods) Set the HTTP methods to allow, e.g. `"GET"`, `"POST"`, etc. The special value `"*"` allows all methods. By default, "simple" methods `GET`, `HEAD`, and `POST` are allowed. Please, see `CorsConfiguration#setAllowedMethods(List)` for details.

public CorsRegistration allowedMethods(String... methods)

Set the HTTP methods to allow, e.g. "GET", "POST", etc. The special value "*" allows all methods. By default, "simple" methods GET, HEAD, and POST are allowed.

Please, see CorsConfiguration#setAllowedMethods(List) for details.

allowedOriginPatterns back to summary

allowedOriginPatterns	back to summary
public CorsRegistration allowedOriginPatterns(String... patterns) Alternative to `allowedOrigins(String...)` that supports more flexible patterns for specifying the origins for which cross-origin requests are allowed from a browser. Please, refer to `CorsConfiguration#setAllowedOriginPatterns(List)` for format details and other considerations. By default this is not set. Since 5.3

public CorsRegistration allowedOriginPatterns(String... patterns)

Alternative to allowedOrigins(String...) that supports more flexible patterns for specifying the origins for which cross-origin requests are allowed from a browser. Please, refer to CorsConfiguration#setAllowedOriginPatterns(List) for format details and other considerations.

By default this is not set.

Since: 5.3

allowedOrigins back to summary

allowedOrigins	back to summary
public CorsRegistration allowedOrigins(String... origins) Set the origins for which cross-origin requests are allowed from a browser. Please, refer to `CorsConfiguration#setAllowedOrigins(List)` for format details and other considerations. By default, all origins are allowed, but if `allowedOriginPatterns` is also set, then that takes precedence. See Also `allowedOriginPatterns(String...)`

public CorsRegistration allowedOrigins(String... origins)

Set the origins for which cross-origin requests are allowed from a browser. Please, refer to CorsConfiguration#setAllowedOrigins(List) for format details and other considerations.

By default, all origins are allowed, but if allowedOriginPatterns is also set, then that takes precedence.

See Also: allowedOriginPatterns(String...)

allowPrivateNetwork	back to summary
public CorsRegistration allowPrivateNetwork(boolean allowPrivateNetwork) Whether private network access is supported. By default this is not set (i.e. private network access is not supported). Since 5.3.32 See Also Private network access specifications

allowPrivateNetwork

back to summary

public CorsRegistration allowPrivateNetwork(boolean allowPrivateNetwork)

Whether private network access is supported.

By default this is not set (i.e. private network access is not supported).

Since: 5.3.32
See Also: Private network access specifications

combine back to summary

combine	back to summary
public CorsRegistration combine(CorsConfiguration other) Apply the given `CorsConfiguration` to the one being configured via `CorsConfiguration#combine(CorsConfiguration)` which in turn has been initialized with `CorsConfiguration#applyPermitDefaultValues()`. Parameters other:CorsConfiguration the configuration to apply Since 5.3

public CorsRegistration combine(CorsConfiguration other)

Apply the given CorsConfiguration to the one being configured via CorsConfiguration#combine(CorsConfiguration) which in turn has been initialized with CorsConfiguration#applyPermitDefaultValues().

Parameters

other:CorsConfiguration: the configuration to apply

Since

5.3

exposedHeaders back to summary

exposedHeaders	back to summary
public CorsRegistration exposedHeaders(String... headers) Set the list of response headers that an actual response might have and can be exposed. The special value `"*"` allows all headers to be exposed. Please, see `CorsConfiguration#setExposedHeaders(List)` for details. By default this is not set.

public CorsRegistration exposedHeaders(String... headers)

Set the list of response headers that an actual response might have and can be exposed. The special value "*" allows all headers to be exposed.

Please, see CorsConfiguration#setExposedHeaders(List) for details.

By default this is not set.

getCorsConfiguration	back to summary
protected CorsConfiguration getCorsConfiguration()

getPathPattern	back to summary
protected String getPathPattern()

maxAge	back to summary
public CorsRegistration maxAge(long maxAge) Configure how long in seconds the response from a pre-flight request can be cached by clients. By default this is set to 1800 seconds (30 minutes).

maxAge

back to summary

public CorsRegistration maxAge(long maxAge)

Configure how long in seconds the response from a pre-flight request can be cached by clients.

By default this is set to 1800 seconds (30 minutes).

public Class CorsRegistration

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail