Java CorsConfiguration.setAllowedHeaders方法代码示例

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
@ConditionalOnProperty(prefix = "cas.httpWebRequest.cors", name = "enabled", havingValue = "true")
@Bean
@RefreshScope
public FilterRegistrationBean casCorsFilter() {
    final HttpWebRequestProperties.Cors cors = casProperties.getHttpWebRequest().getCors();
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    final CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(cors.isEnabled());
    config.setAllowedOrigins(cors.getAllowOrigins());
    config.setAllowedMethods(cors.getAllowMethods());
    config.setAllowedHeaders(cors.getAllowHeaders());
    config.setMaxAge(cors.getMaxAge());
    config.setExposedHeaders(cors.getExposedHeaders());
    source.registerCorsConfiguration("/**", config);
    final FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setName("casCorsFilter");
    bean.setAsyncSupported(true);
    bean.setOrder(0);
    return bean;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
/**
 * <a href="https://github.com/spring-projects/spring-boot/issues/5834#issuecomment-296370088">See explanation here</a>
 */
@Bean
public FilterRegistrationBean corsFilterBean() {
	final CorsConfiguration configuration = new CorsConfiguration();
	configuration.setAllowedOrigins(Collections.singletonList("*"));
	configuration.setAllowedMethods(Arrays.asList("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));
	// setAllowCredentials(true) is important, otherwise:
	// The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
	configuration.setAllowCredentials(true);
	// setAllowedHeaders is important! Without it, OPTIONS preflight request
	// will fail with 403 Invalid CORS request
	configuration.setAllowedHeaders(Arrays.asList("Authorization", "Cache-Control", "Content-Type"));
	final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
	source.registerCorsConfiguration("/**", configuration);
	FilterRegistrationBean corsFilter = new FilterRegistrationBean(new CorsFilter(source));
	corsFilter.setOrder(Ordered.HIGHEST_PRECEDENCE);
	return corsFilter;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
@Bean
public CorsConfigurationSource corsConfigurationSource() {
	CorsConfiguration configuration = new CorsConfiguration();
	configuration.setAllowedOrigins(ImmutableList.of("*"));
	configuration.setAllowedMethods(ImmutableList.of("*"));
	configuration.setAllowCredentials(true);

	configuration.setAllowedHeaders(ImmutableList.of("*"));
	UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
	source.registerCorsConfiguration("/**", configuration);

	return source;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
/**
 * CORS配置
 * 
 * @return
 */
private CorsConfiguration buildConfig() {
	// 新建CORS配置
	CorsConfiguration corsConfiguration = new CorsConfiguration();
	// 设置允许访问的请求源HTTP
	corsConfiguration.addAllowedOrigin("*");
	// 设置允许访问的请求源方法
	corsConfiguration.addAllowedMethod("*");
	corsConfiguration.setAllowCredentials(true);
	// 添加了新的header，需要配置白名单
	List<String> allowedHeaders = Lists.newArrayList();
	allowedHeaders.add("Content-Type");
	allowedHeaders.add("authorization");
	allowedHeaders.add("x-requested-with");
	corsConfiguration.setAllowedHeaders(allowedHeaders);
	// 返回CORS配置
	return corsConfiguration;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
/**
 * CORS:
 * <p>
 * Do not do any of below, which are the wrong way to attempt solving the ajax problem:
 * - http.authorizeRequests().antMatchers(HttpMethod.OPTIONS, "/**").permitAll();
 * - web.ignoring().antMatchers(HttpMethod.OPTIONS)
 * <p>
 * Global CORS configuration
 * https://spring.io/blog/2015/06/08/cors-support-in-spring-framework
 * https://docs.spring.io/spring-security/site/docs/current/reference/html/cors.html
 * <p>
 * Solution 1
 * add CrossOrigin annotation to Controller class or methods
 * <p>
 * Solution 2
 * override addCorsMappings(CorsRegistry registry) method of WebMvcConfigurerAdapter class
 * <p>
 * <p>
 * The follow method will override CORS Configuration provided by Spring MVC.
 */
@Bean
public FilterRegistrationBean initCorsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();

    // setAllowCredentials(true) is important, otherwise:
    // The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
    config.setAllowCredentials(true);

    // setAllowedHeaders is important! Without it, OPTIONS preflight request
    // will fail with 403 Invalid CORS request
    config.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type"));

    config.addAllowedMethod("*");

    String origins = this.applicationConfig.getAllowedOrigins();
    if (origins != null && !"".equals(origins)) {
        config.setAllowedOrigins(Arrays.asList(StringHelper.splitWithoutWhitespace(origins, ",")));
    }
    source.registerCorsConfiguration("/**", config);
    FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
    return bean;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
private CorsConfiguration getCorsConfiguration(EndpointCorsProperties properties) {
	if (CollectionUtils.isEmpty(properties.getAllowedOrigins())) {
		return null;
	}
	CorsConfiguration configuration = new CorsConfiguration();
	configuration.setAllowedOrigins(properties.getAllowedOrigins());
	if (!CollectionUtils.isEmpty(properties.getAllowedHeaders())) {
		configuration.setAllowedHeaders(properties.getAllowedHeaders());
	}
	if (!CollectionUtils.isEmpty(properties.getAllowedMethods())) {
		configuration.setAllowedMethods(properties.getAllowedMethods());
	}
	if (!CollectionUtils.isEmpty(properties.getExposedHeaders())) {
		configuration.setExposedHeaders(properties.getExposedHeaders());
	}
	if (properties.getMaxAge() != null) {
		configuration.setMaxAge(properties.getMaxAge());
	}
	if (properties.getAllowCredentials() != null) {
		configuration.setAllowCredentials(properties.getAllowCredentials());
	}
	return configuration;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
@Bean
public CorsFilter corsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration corsConfiguration = new CorsConfiguration();

    corsConfiguration.setAllowedOrigins(Arrays.asList("http://localhost:4200"));
    corsConfiguration.setAllowedMethods(Arrays.asList(CorsConfiguration.ALL));
    corsConfiguration.setAllowedHeaders(Arrays.asList(CorsConfiguration.ALL));
    corsConfiguration.addExposedHeader(SecurityConstant.HEADER_SECURITY_TOKEN);
    corsConfiguration.setAllowCredentials(true);

    source.registerCorsConfiguration("/**", corsConfiguration);
    return new CorsFilter(source);
}
 

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
protected CorsConfigurationSource corsConfigurationSource() {
    final CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowCredentials(true);
    configuration.setAllowedOrigins(Arrays.asList("*"));
    configuration.setAllowedMethods(Arrays.asList("GET", "POST", "DELETE", "PUT"));
    configuration.setAllowedHeaders(Arrays.asList("X-Requested-With", "Authorization"));
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
@Override
protected CorsConfiguration initCorsConfiguration(Object handler, Method method, RequestMappingInfo mappingInfo) {
	HandlerMethod handlerMethod = createHandlerMethod(handler, method);
	CrossOrigin typeAnnotation = AnnotatedElementUtils.findMergedAnnotation(handlerMethod.getBeanType(), CrossOrigin.class);
	CrossOrigin methodAnnotation = AnnotatedElementUtils.findMergedAnnotation(method, CrossOrigin.class);

	if (typeAnnotation == null && methodAnnotation == null) {
		return null;
	}

	CorsConfiguration config = new CorsConfiguration();
	updateCorsConfig(config, typeAnnotation);
	updateCorsConfig(config, methodAnnotation);

	if (CollectionUtils.isEmpty(config.getAllowedOrigins())) {
		config.setAllowedOrigins(Arrays.asList(CrossOrigin.DEFAULT_ORIGINS));
	}
	if (CollectionUtils.isEmpty(config.getAllowedMethods())) {
		for (RequestMethod allowedMethod : mappingInfo.getMethodsCondition().getMethods()) {
			config.addAllowedMethod(allowedMethod.name());
		}
	}
	if (CollectionUtils.isEmpty(config.getAllowedHeaders())) {
		config.setAllowedHeaders(Arrays.asList(CrossOrigin.DEFAULT_ALLOWED_HEADERS));
	}
	if (config.getAllowCredentials() == null) {
		config.setAllowCredentials(CrossOrigin.DEFAULT_ALLOW_CREDENTIALS);
	}
	if (config.getMaxAge() == null) {
		config.setMaxAge(CrossOrigin.DEFAULT_MAX_AGE);
	}
	return config;
}
 

import org.springframework.web.cors.CorsConfiguration; //导入方法依赖的package包/类
@Bean
public CorsConfigurationSource corsConfigurationSource() {
    final CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(ImmutableList.of("http://localhost:4200"));
    configuration.setAllowedMethods(Arrays.asList(CORS_ALLOWED_METHODS));
    configuration.setAllowCredentials(false);
    configuration.setAllowedHeaders(Arrays.asList(CORS_ALLOW_HEADERS));

    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}