Java CorsConfiguration类代码示例

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
/**
 * CORS配置
 * 
 * @return
 */
private CorsConfiguration buildConfig() {
	// 新建CORS配置
	CorsConfiguration corsConfiguration = new CorsConfiguration();
	// 设置允许访问的请求源HTTP
	corsConfiguration.addAllowedOrigin("*");
	// 设置允许访问的请求源方法
	corsConfiguration.addAllowedMethod("*");
	corsConfiguration.setAllowCredentials(true);
	// 添加了新的header，需要配置白名单
	List<String> allowedHeaders = Lists.newArrayList();
	allowedHeaders.add("Content-Type");
	allowedHeaders.add("authorization");
	allowedHeaders.add("x-requested-with");
	corsConfiguration.setAllowedHeaders(allowedHeaders);
	// 返回CORS配置
	return corsConfiguration;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
public FilterRegistrationBean filterRegistrationBean() {
    final UrlBasedCorsConfigurationSource urlBasedCorsConfigurationSource = new UrlBasedCorsConfigurationSource();

    final CorsConfiguration corsConfiguration = new CorsConfiguration();
    corsConfiguration.setAllowCredentials(corsSupportProperties.isAllowCredentials());
    corsConfiguration.addAllowedOrigin(corsSupportProperties.getAllowOrigin());
    corsConfiguration.addAllowedHeader(corsSupportProperties.getAllowHeader());
    corsConfiguration.addAllowedMethod(corsSupportProperties.getAllowMethod());

    urlBasedCorsConfigurationSource.registerCorsConfiguration("/**", corsConfiguration);

    CorsFilter corsFilter = new CorsFilter(urlBasedCorsConfigurationSource);
    FilterRegistrationBean registration = new FilterRegistrationBean(corsFilter);
    registration.addUrlPatterns("/*");
    registration.setOrder(Ordered.HIGHEST_PRECEDENCE);
    return registration;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
HandlerMapping webSocketMapping(CommentService commentService) {
	Map<String, WebSocketHandler> urlMap = new HashMap<>();
	urlMap.put("/topic/comments.new", commentService);

	Map<String, CorsConfiguration> corsConfigurationMap =
		new HashMap<>();
	CorsConfiguration corsConfiguration = new CorsConfiguration();
	corsConfiguration.addAllowedOrigin("http://localhost:8080");
	corsConfigurationMap.put(
		"/topic/comments.new", corsConfiguration);

	SimpleUrlHandlerMapping mapping = new SimpleUrlHandlerMapping();
	mapping.setOrder(10);
	mapping.setUrlMap(urlMap);
	mapping.setCorsConfigurations(corsConfigurationMap);

	return mapping;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
FilterRegistrationBean corsFilter() {
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.addAllowedOrigin("*");
    config.addAllowedHeader("*");
    config.addAllowedMethod("*");

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", config);

    FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(Ordered.HIGHEST_PRECEDENCE);

    return bean;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
HandlerMapping webSocketMapping(CommentService commentService,
								InboundChatService inboundChatService,
								OutboundChatService outboundChatService) {
	SimpleUrlHandlerMapping mapping =
		configureUrlMappings(commentService, inboundChatService, outboundChatService);

	Map<String, CorsConfiguration> corsConfigurationMap = new HashMap<>();
	CorsConfiguration corsConfiguration = new CorsConfiguration();
	corsConfiguration.addAllowedOrigin(chatConfigProperties.getOrigin());

	mapping.getUrlMap().keySet().forEach(route ->
		corsConfigurationMap.put(route, corsConfiguration)
	);

	mapping.setCorsConfigurations(corsConfigurationMap);

	return mapping;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@ConditionalOnProperty(prefix = "cas.httpWebRequest.cors", name = "enabled", havingValue = "true")
@Bean
@RefreshScope
public FilterRegistrationBean casCorsFilter() {
    final HttpWebRequestProperties.Cors cors = casProperties.getHttpWebRequest().getCors();
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    final CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(cors.isEnabled());
    config.setAllowedOrigins(cors.getAllowOrigins());
    config.setAllowedMethods(cors.getAllowMethods());
    config.setAllowedHeaders(cors.getAllowHeaders());
    config.setMaxAge(cors.getMaxAge());
    config.setExposedHeaders(cors.getExposedHeaders());
    source.registerCorsConfiguration("/**", config);
    final FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setName("casCorsFilter");
    bean.setAsyncSupported(true);
    bean.setOrder(0);
    return bean;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
/**
 * <a href="https://github.com/spring-projects/spring-boot/issues/5834#issuecomment-296370088">See explanation here</a>
 */
@Bean
public FilterRegistrationBean corsFilterBean() {
	final CorsConfiguration configuration = new CorsConfiguration();
	configuration.setAllowedOrigins(Collections.singletonList("*"));
	configuration.setAllowedMethods(Arrays.asList("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));
	// setAllowCredentials(true) is important, otherwise:
	// The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
	configuration.setAllowCredentials(true);
	// setAllowedHeaders is important! Without it, OPTIONS preflight request
	// will fail with 403 Invalid CORS request
	configuration.setAllowedHeaders(Arrays.asList("Authorization", "Cache-Control", "Content-Type"));
	final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
	source.registerCorsConfiguration("/**", configuration);
	FilterRegistrationBean corsFilter = new FilterRegistrationBean(new CorsFilter(source));
	corsFilter.setOrder(Ordered.HIGHEST_PRECEDENCE);
	return corsFilter;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
public FilterRegistrationBean corsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.addAllowedOrigin("*");
    config.addAllowedHeader("*");
    config.addAllowedMethod("OPTIONS");
    config.addAllowedMethod("HEAD");
    config.addAllowedMethod("GET");
    config.addAllowedMethod("PUT");
    config.addAllowedMethod("POST");
    config.addAllowedMethod("DELETE");
    config.addAllowedMethod("PATCH");
    source.registerCorsConfiguration("/**", config);
    // return new CorsFilter(source);
    final FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(0);
    return bean;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
public CorsFilter corsFilter() {
    return new CorsFilter(request -> {
        String pathInfo = request.getPathInfo();
        if (pathInfo != null &&
            (pathInfo.endsWith("/swagger.json") ||
             pathInfo.endsWith("/swagger.yaml"))) {
            return new CorsConfiguration().applyPermitDefaultValues();
        }

        CorsConfiguration config = new CorsConfiguration();
        config.setAllowedOrigins(allowedOrigins);
        config.setAllowedMethods(Arrays.asList("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));
        config.applyPermitDefaultValues();
        return config;
    });
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
public CorsFilter corsFilter() {

    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    final CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);

    // TODO - Lock down to specific host in Prod
    config.addAllowedOrigin("*");
    //config.addAllowedOrigin("http://localhost:3000");

    config.addAllowedHeader("*");
    config.addAllowedMethod("OPTIONS");
    config.addAllowedMethod("GET");
    config.addAllowedMethod("POST");
    config.addAllowedMethod("PUT");
    config.addAllowedMethod("DELETE");
    source.registerCorsConfiguration("/**", config);
    return new CorsFilter(source);
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
public CorsConfigurationSource corsConfigurationSource() {
	CorsConfiguration configuration = new CorsConfiguration();
	configuration.setAllowedOrigins(ImmutableList.of("*"));
	configuration.setAllowedMethods(ImmutableList.of("*"));
	configuration.setAllowCredentials(true);

	configuration.setAllowedHeaders(ImmutableList.of("*"));
	UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
	source.registerCorsConfiguration("/**", configuration);

	return source;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
public FilterRegistrationBean corsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();

    config.setAllowCredentials(true);
    config.addAllowedOrigin("*");
    config.addAllowedHeader("*");

    config.addExposedHeader("WWW-Authenticate");
    config.addExposedHeader("Access-Control-Allow-Origin");
    config.addExposedHeader("Access-Control-Allow-Headers");

    config.addAllowedMethod("OPTIONS");
    config.addAllowedMethod("HEAD");
    config.addAllowedMethod("GET");
    config.addAllowedMethod("PUT");
    config.addAllowedMethod("POST");
    config.addAllowedMethod("DELETE");
    config.addAllowedMethod("PATCH");
    source.registerCorsConfiguration("/**", config);

    final FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(0);
    return bean;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
private CorsFilter getCorsFilter() {

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.addAllowedOrigin("*");
    config.addAllowedHeader("*");
    config.addAllowedMethod("OPTIONS");
    config.addAllowedMethod("HEAD");
    config.addAllowedMethod("GET");
    config.addAllowedMethod("PUT");
    config.addAllowedMethod("POST");
    config.addAllowedMethod("DELETE");
    config.addAllowedMethod("PATCH");
    source.registerCorsConfiguration("/**", config);
    return new CorsFilter(source);
  }
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
@Bean
public FilterRegistrationBean corsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.addAllowedOrigin("*");
    config.addAllowedHeader("*");
    config.addAllowedMethod("OPTIONS");
    config.addAllowedMethod("HEAD");
    config.addAllowedMethod("GET");
    config.addAllowedMethod("PUT");
    config.addAllowedMethod("POST");
    config.addAllowedMethod("DELETE");
    config.addAllowedMethod("PATCH");
    source.registerCorsConfiguration("/**", config);
    final FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(0);
    return bean;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入依赖的package包/类
/**
 * CORS:
 * <p>
 * Do not do any of below, which are the wrong way to attempt solving the ajax problem:
 * - http.authorizeRequests().antMatchers(HttpMethod.OPTIONS, "/**").permitAll();
 * - web.ignoring().antMatchers(HttpMethod.OPTIONS)
 * <p>
 * Global CORS configuration
 * https://spring.io/blog/2015/06/08/cors-support-in-spring-framework
 * https://docs.spring.io/spring-security/site/docs/current/reference/html/cors.html
 * <p>
 * Solution 1
 * add CrossOrigin annotation to Controller class or methods
 * <p>
 * Solution 2
 * override addCorsMappings(CorsRegistry registry) method of WebMvcConfigurerAdapter class
 * <p>
 * <p>
 * The follow method will override CORS Configuration provided by Spring MVC.
 */
@Bean
public FilterRegistrationBean initCorsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();

    // setAllowCredentials(true) is important, otherwise:
    // The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
    config.setAllowCredentials(true);

    // setAllowedHeaders is important! Without it, OPTIONS preflight request
    // will fail with 403 Invalid CORS request
    config.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type"));

    config.addAllowedMethod("*");

    String origins = this.applicationConfig.getAllowedOrigins();
    if (origins != null && !"".equals(origins)) {
        config.setAllowedOrigins(Arrays.asList(StringHelper.splitWithoutWhitespace(origins, ",")));
    }
    source.registerCorsConfiguration("/**", config);
    FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
    return bean;
}