Package org.springframework.web.cors

Class UrlBasedCorsConfigurationSource

java.lang.Object
org.springframework.web.cors.UrlBasedCorsConfigurationSource
All Implemented Interfaces:
CorsConfigurationSource
public class UrlBasedCorsConfigurationSource extends Object implements CorsConfigurationSource
CorsConfigurationSource that uses URL path patterns to select the CorsConfiguration for a request.

Pattern matching can be done with a PathMatcher or with pre-parsed PathPatterns. The syntax is largely the same with the latter being more tailored for web usage and more efficient. The choice depends on the presence of a resolved String lookupPath or a parsed RequestPath with a fallback on PathMatcher but the fallback can be disabled. For more details, please see setAllowInitLookupPath(boolean).

Since:
4.2
Author:
Sebastien Deleuze, Rossen Stoyanchev
See Also:

  • Constructor Details

    • UrlBasedCorsConfigurationSource

      public UrlBasedCorsConfigurationSource()
      Default constructor with PathPatternParser.defaultInstance.

    • UrlBasedCorsConfigurationSource

      public UrlBasedCorsConfigurationSource(PathPatternParser parser)
      Constructor with a PathPatternParser to parse patterns with.
      Parameters:
      parser - the parser to use
      Since:
      5.3

  • Method Details

    • setAlwaysUseFullPath

      @Deprecated public void setAlwaysUseFullPath(boolean alwaysUseFullPath)
      Deprecated.
      as of 5.3 in favor of using setUrlPathHelper(UrlPathHelper), if at all. For further details, please see setAllowInitLookupPath(boolean).
      Shortcut to the same property on the configured UrlPathHelper.

    • setUrlDecode

      @Deprecated public void setUrlDecode(boolean urlDecode)
      Deprecated.
      as of 5.3 in favor of using setUrlPathHelper(UrlPathHelper), if at all. For further details, please see setAllowInitLookupPath(boolean).
      Shortcut to the same property on the configured UrlPathHelper.

    • setRemoveSemicolonContent

      @Deprecated public void setRemoveSemicolonContent(boolean removeSemicolonContent)
      Deprecated.
      as of 5.3 in favor of using setUrlPathHelper(UrlPathHelper), if at all. For further details, please see setAllowInitLookupPath(boolean).
      Shortcut to the same property on the configured UrlPathHelper.

    • setUrlPathHelper

      public void setUrlPathHelper(UrlPathHelper urlPathHelper)
      Configure the UrlPathHelper to resolve the lookupPath. This may not be necessary if the lookupPath is expected to be pre-resolved or if parsed PathPatterns are used instead. For further details on that, see setAllowInitLookupPath(boolean).

      By default this is UrlPathHelper.defaultInstance.

    • setAllowInitLookupPath

      public void setAllowInitLookupPath(boolean allowInitLookupPath)
      When enabled, if there is neither a esolved String lookupPath nor a parsed RequestPath then use the configured UrlPathHelper to resolve a String lookupPath. This in turn determines use of URL pattern matching with PathMatcher or with parsed PathPatterns.

      In Spring MVC, either a resolved String lookupPath or a parsed RequestPath is always available within DispatcherServlet processing. However, in a Servlet Filter such as CorsFilter that may or may not be the case.

      By default this is set to true in which case lazy lookupPath initialization is allowed. Set this to false when an application is using parsed PathPatterns in which case the RequestPath can be parsed earlier via ServletRequestPathFilter.

      Parameters:
      allowInitLookupPath - whether to disable lazy initialization and fail if not already resolved
      Since:
      5.3

    • setLookupPathAttributeName

      @Deprecated public void setLookupPathAttributeName(String name)
      Deprecated.
      as of 5.3 in favor of UrlPathHelper.PATH_ATTRIBUTE.
      Configure the name of the attribute that holds the lookupPath extracted via UrlPathHelper.getLookupPathForRequest(HttpServletRequest).

      By default this is UrlPathHelper.PATH_ATTRIBUTE.

      Parameters:
      name - the request attribute to check
      Since:
      5.2

    • setPathMatcher

      public void setPathMatcher(org.springframework.util.PathMatcher pathMatcher)
      Configure a PathMatcher to use for pattern matching.

      This is an advanced property that should be used only when a customized AntPathMatcher or a custom PathMatcher is required.

      By default this is AntPathMatcher.

      Note: Setting PathMatcher enforces use of String pattern matching even when a parsed RequestPath is available.

    • setCorsConfigurations

      public void setCorsConfigurations(@Nullable Map<String,CorsConfiguration> corsConfigurations)
      Set the CORS configuration mappings.

      For pattern syntax see AntPathMatcher and PathPattern as well as class-level Javadoc for details on which one may in use. Generally the syntax is largely the same with PathPattern more tailored for web usage.

      Parameters:
      corsConfigurations - the mappings to use
      See Also:

    • registerCorsConfiguration

      public void registerCorsConfiguration(String pattern, CorsConfiguration config)
      Variant of setCorsConfigurations(Map) to register one mapping at a time.
      Parameters:
      pattern - the mapping pattern
      config - the CORS configuration to use for the pattern
      See Also:

    • getCorsConfigurations

      public Map<String,CorsConfiguration> getCorsConfigurations()
      Return all configured CORS mappings.

    • getCorsConfiguration

      @Nullable public CorsConfiguration getCorsConfiguration(HttpServletRequest request)
      Description copied from interface: CorsConfigurationSource
      Return a CorsConfiguration based on the incoming request.
      Specified by:
      getCorsConfiguration in interface CorsConfigurationSource
      Returns:
      the associated CorsConfiguration, or null if none