Java Code Examples for org.springframework.web.cors.CorsConfiguration#setAllowedOrigins()

/**
 * CORS跨域设置
 *
 * @return
 */
@Bean
public FilterRegistrationBean corsFilter(SpringBootPlusCorsProperties corsProperties) {
    log.debug("corsProperties:{}", corsProperties);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration corsConfiguration = new CorsConfiguration();
    // 跨域配置
    corsConfiguration.setAllowedOrigins(corsProperties.getAllowedOrigins());
    corsConfiguration.setAllowedHeaders(corsProperties.getAllowedHeaders());
    corsConfiguration.setAllowedMethods(corsProperties.getAllowedMethods());
    corsConfiguration.setAllowCredentials(corsProperties.isAllowCredentials());
    corsConfiguration.setExposedHeaders(corsProperties.getExposedHeaders());
    corsConfiguration.setMaxAge(corsConfiguration.getMaxAge());

    source.registerCorsConfiguration(corsProperties.getPath(), corsConfiguration);
    FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
    bean.setEnabled(corsProperties.isEnable());
    return bean;
}
 

@Bean
public CorsConfigurationSource corsConfigurationSource() {
	final CorsConfiguration configuration = new CorsConfiguration();
	configuration.setAllowedOrigins(ImmutableList.of("*"));
	configuration.setAllowedMethods(ImmutableList.of("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));

	// setAllowCredentials(true) is important, otherwise:
	// The value of the 'Access-Control-Allow-Origin' header in the response must
	// not be the wildcard '*' when the request's credentials mode is 'include'.
	configuration.setAllowCredentials(true);

	// setAllowedHeaders is important! Without it, OPTIONS preflight request
	// will fail with 403 Invalid CORS request
	configuration.setAllowedHeaders(ImmutableList.of("*"));

	final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
	source.registerCorsConfiguration("/**", configuration);
	return source;
}
 

/**
 * 跨域配置
 */
@Bean
public CorsConfigurationSource corsConfigurationSource() {
    // 允许跨域访问的 URL
    List<String> allowedOriginsUrl = new ArrayList<>();
    allowedOriginsUrl.add("http://localhost:8080");
    allowedOriginsUrl.add("http://127.0.0.1:8080");
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    // 设置允许跨域访问的 URL
    config.setAllowedOrigins(allowedOriginsUrl);
    config.addAllowedHeader("*");
    config.addAllowedMethod("*");
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", config);
    return source;
}
 

@Bean
public CorsConfigurationSource corsConfigurationSource() {
  CorsConfiguration configuration = new CorsConfiguration().applyPermitDefaultValues();
  configuration.setAllowedOrigins(ImmutableList.of("*"));
  configuration.setAllowedMethods(ImmutableList.of("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));
  // setAllowCredentials(true) is important, otherwise:
  // The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the
  // request's credentials mode is 'include'.
  configuration.setAllowCredentials(true);
  // setAllowedHeaders is important! Without it, OPTIONS preflight request
  // will fail with 403 Invalid CORS request
  configuration.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type"));

  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  source.registerCorsConfiguration("/**", configuration);
  return source;
}
 

@Bean
public CorsFilter corsFilter() {
    return new CorsFilter(request -> {
        String pathInfo = request.getPathInfo();
        if (pathInfo != null &&
            (pathInfo.endsWith("/openapi.json") ||
             pathInfo.endsWith("/openapi.yaml"))) {
            return new CorsConfiguration().applyPermitDefaultValues();
        }

        CorsConfiguration config = new CorsConfiguration();
        config.setAllowedOrigins(allowedOrigins);
        config.setAllowedMethods(Arrays.asList("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));
        config.applyPermitDefaultValues();
        return config;
    });
}
 

/**
 * 跨域配置
 *
 * @return
 */
@Bean
public FilterRegistrationBean corsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.setAllowedHeaders(Lists.newArrayList(ALLOWED_HEADERS.split(",")));
    config.setAllowedOrigins(Lists.newArrayList(ALLOWED_ORIGIN.split(",")));
    config.setAllowedMethods(Lists.newArrayList(ALLOWED_METHODS.split(",")));
    config.setMaxAge(MAX_AGE);
    config.addExposedHeader(ALLOWED_EXPOSE);

    source.registerCorsConfiguration("/**", config);
    FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    //最大优先级,设置0不好使
    bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
    log.info("CorsFilter [{}]", bean);
    return bean;
}
 

@Bean
public CorsFilter corsFilter() {
	UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
	CorsConfiguration config = new CorsConfiguration();
	config.setAllowedOrigins(Arrays.asList("*"));
	config.setAllowedHeaders(Arrays.asList("*"));
	config.setAllowedMethods(Arrays.asList("*"));
	source.registerCorsConfiguration("/**", config);
	return new CorsFilter(source);
}
 

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    final CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("*"));
    configuration.setAllowedMethods(Arrays.asList("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));
    configuration.setAllowedHeaders(Arrays.asList("Authorization", "Cache-Control", "Content-Type"));
    configuration.setAllowCredentials(false);
    configuration.setMaxAge(3600L);
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/api/**", configuration);
    return source;
}
 

@SuppressWarnings("unchecked")
@Bean
public FilterRegistrationBean corsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration corsConfiguration = new CorsConfiguration();
    corsConfiguration.setAllowCredentials(true);
    corsConfiguration.setAllowedOrigins(Arrays.asList(CorsConfiguration.ALL));
    corsConfiguration.setAllowedHeaders(Arrays.asList(CorsConfiguration.ALL));
    corsConfiguration.setAllowedMethods(Arrays.asList(CorsConfiguration.ALL));
    source.registerCorsConfiguration("/**", corsConfiguration);
    FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
    return bean;
}
 

@Override
@Nullable
public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {
	if (!this.suppressCors && CorsUtils.isCorsRequest(request)) {
		CorsConfiguration config = new CorsConfiguration();
		config.setAllowedOrigins(new ArrayList<>(this.allowedOrigins));
		config.addAllowedMethod("*");
		config.setAllowCredentials(true);
		config.setMaxAge(ONE_YEAR);
		config.addAllowedHeader("*");
		return config;
	}
	return null;
}
 

@Bean
public FilterRegistrationBean<CorsFilter> simpleCorsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.setAllowedOrigins(Collections.singletonList("*"));
    config.setAllowedMethods(Collections.singletonList("*"));
    config.setAllowedHeaders(Collections.singletonList("*"));
    source.registerCorsConfiguration("/**", config);
    FilterRegistrationBean<CorsFilter> bean = new FilterRegistrationBean<>(new CorsFilter(source));
    bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
    return bean;
}
 

@Bean
CorsWebFilter corsWebFilter() {
    CorsConfiguration corsConfig = new CorsConfiguration();
    corsConfig.setAllowedOrigins(List.of("*"));
    corsConfig.setMaxAge(3600L);
    corsConfig.addAllowedMethod("*");
    corsConfig.addAllowedHeader("*");

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", corsConfig);

    return new CorsWebFilter(source);
}
 

private CorsConfiguration buildConfiguration(CorsProperties.CorsConfiguration config) {
    CorsConfiguration corsConfiguration = new CorsConfiguration();
    corsConfiguration.setAllowedHeaders(config.getAllowedHeaders());
    corsConfiguration.setAllowedMethods(config.getAllowedMethods());
    corsConfiguration.setAllowedOrigins(config.getAllowedOrigins());
    corsConfiguration.setAllowCredentials(config.getAllowCredentials());
    corsConfiguration.setExposedHeaders(config.getExposedHeaders());
    corsConfiguration.setMaxAge(config.getMaxAge());

    return corsConfiguration;
}
 

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    final CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.setAllowedOrigins(getPropertiesAsList("http.cors.allow-origin", "*"));
    config.setAllowedHeaders(getPropertiesAsList("http.cors.allow-headers", "Cache-Control, Pragma, Origin, Authorization, Content-Type, X-Requested-With, If-Match, " + DEFAULT_CSRF_HEADER_NAME + ", " + DEFAULT_RECAPTCHA_HEADER_NAME));
    config.setAllowedMethods(getPropertiesAsList("http.cors.allow-methods", "OPTIONS, GET, POST, PUT, DELETE, PATCH"));
    config.setExposedHeaders(getPropertiesAsList("http.cors.exposed-headers", "ETag, " + DEFAULT_CSRF_HEADER_NAME));
    config.setMaxAge(environment.getProperty("http.cors.max-age", Long.class, 1728000L));

    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", config);
    return source;
}
 

/**
 * This special filter is needed so unauthorized request that are rejected by Spring security
 * still have CORS headers.
 * For some reason he {@code bean.setOrder} call is not enough, the configuration also needs
 * {@code security.filter-order=5} for the CORS filter to be in front of the Spring Security
 * filter.
 */
@Bean
public FilterRegistrationBean corsFilter() {
    //based on https://github.com/spring-projects/spring-boot/issues/5834
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.setAllowedOrigins(Collections.singletonList("*"));
    config.setAllowedMethods(Collections.singletonList("*"));
    config.setAllowedHeaders(Collections.singletonList("*"));
    source.registerCorsConfiguration("/**", config);
    FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(0);
    return bean;
}
 

@Bean
CorsConfigurationSource corsConfigurationSource() {
	CorsConfiguration configuration = new CorsConfiguration();
	configuration.setAllowedOrigins(Arrays.asList("*"));
	configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "DELETE"));
	UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
	source.registerCorsConfiguration("/**", configuration);
	return source;
}
 

@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Collections.singletonList("https://example.com"));
    configuration.setAllowedMethods(Arrays.asList("GET","POST"));
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}
 

@Bean
public FilterRegistrationBean<CorsFilter> corsFilterRegistration() {
	FilterRegistrationBean<CorsFilter> filter = new FilterRegistrationBean<>();
	CorsConfiguration config = new CorsConfiguration();
	config.setAllowedOrigins(Collections.singletonList(CorsConfiguration.ALL));
	config.setAllowedMethods(Collections.singletonList(CorsConfiguration.ALL));
	config.setAllowedHeaders(Collections.singletonList(CorsConfiguration.ALL));
	config.setAllowCredentials(true);
	filter.setFilter(new CorsFilter(r -> config));
	filter.setUrlPatterns(Collections.singleton("/*"));
	filter.setOrder(SecurityProperties.DEFAULT_FILTER_ORDER - 1);
	return filter;
}
 

/**
 * used for CORS validation, A container for CORS configuration to validate
 * against the actual origin, HTTP methods, and headers of a given request.
 * 
 * @return
 */
@Bean
public CorsConfigurationSource corsConfigurationSource() {
	LOG.debug("Setting up corsConfigurationSource ");
	CorsConfiguration configuration = new CorsConfiguration();
	configuration.setAllowedOrigins(Arrays.asList("*"));
	configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "PUT", "DELETE", "PATCH"));
	configuration.setAllowCredentials(true);
	configuration.setAllowedHeaders(Arrays.asList("*"));
	UrlBasedCorsConfigurationSource sourceCors = new UrlBasedCorsConfigurationSource();
	sourceCors.registerCorsConfiguration("/**", configuration);
	return sourceCors;
}
 

@Override
protected CorsConfiguration initCorsConfiguration(Object handler, Method method, String mapping) {
	CorsConfiguration corsConfig = new CorsConfiguration();
	corsConfig.setAllowedOrigins(Collections.singletonList("http://" + handler.hashCode() + method.getName()));
	return corsConfig;
}