public class CorsFilter extends OncePerRequestFilter
Filter that handles CORS preflight requests and intercepts
CORS simple and actual requests thanks to a CorsProcessor implementation
(DefaultCorsProcessor by default) in order to add the relevant CORS
response headers (like Access-Control-Allow-Origin) using the provided
CorsConfigurationSource (for example an UrlBasedCorsConfigurationSource
instance.
This is an alternative to Spring MVC Java config and XML namespace CORS configuration,
useful for applications depending only on spring-web (not on spring-webmvc) or for
security constraints requiring CORS checks to be performed at Filter
level.
This filter could be used in conjunction with DelegatingFilterProxy in order
to help with its initialization.
ALREADY_FILTERED_SUFFIXlogger| Constructor and Description |
|---|
CorsFilter(CorsConfigurationSource configSource)
Constructor accepting a
CorsConfigurationSource used by the filter
to find the CorsConfiguration to use for each incoming request. |
| Modifier and Type | Method and Description |
|---|---|
protected void |
doFilterInternal(HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain)
Same contract as for
doFilter, but guaranteed to be
just invoked once per request within a single request thread. |
void |
setCorsProcessor(CorsProcessor processor)
Configure a custom
CorsProcessor to use to apply the matched
CorsConfiguration for a request. |
doFilter, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted, shouldNotFilter, shouldNotFilterAsyncDispatch, shouldNotFilterErrorDispatchaddRequiredProperty, afterPropertiesSet, destroy, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContextpublic CorsFilter(CorsConfigurationSource configSource)
CorsConfigurationSource used by the filter
to find the CorsConfiguration to use for each incoming request.UrlBasedCorsConfigurationSourcepublic void setCorsProcessor(CorsProcessor processor)
CorsProcessor to use to apply the matched
CorsConfiguration for a request.
By default DefaultCorsProcessor is used.
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException
OncePerRequestFilterdoFilter, but guaranteed to be
just invoked once per request within a single request thread.
See OncePerRequestFilter.shouldNotFilterAsyncDispatch() for details.
Provides HttpServletRequest and HttpServletResponse arguments instead of the default ServletRequest and ServletResponse ones.
doFilterInternal in class OncePerRequestFilterServletExceptionIOException