java.io.Serializable
, Filter
, FilterConfig
public class CorsFilter extends GenericFilter
A Filter
that enable client-side cross-origin requests
by implementing W3C's CORS (Cross-Origin Resource
Sharing) specification for resources. Each HttpServletRequest
request is inspected as per specification, and appropriate response headers
are added to HttpServletResponse
.
By default, it also sets following request attributes, that help to determine the nature of the request downstream.
true
if a CORS request; false
otherwise.Modifier and Type | Class | Description |
---|---|---|
protected static class |
CorsFilter.CORSRequestType |
Enumerates varies types of CORS requests.
|
Modifier and Type | Field | Description |
---|---|---|
static java.lang.String |
DEFAULT_ALLOWED_HTTP_HEADERS |
By default, following headers are supported:
Origin,Accept,X-Requested-With, Content-Type,
Access-Control-Request-Method, and Access-Control-Request-Headers.
|
static java.lang.String |
DEFAULT_ALLOWED_HTTP_METHODS |
By default, following methods are supported: GET, POST, HEAD and OPTIONS.
|
static java.lang.String |
DEFAULT_ALLOWED_ORIGINS |
By default, no origins are allowed to make requests.
|
static java.lang.String |
DEFAULT_DECORATE_REQUEST |
By default, request is decorated with CORS attributes.
|
static java.lang.String |
DEFAULT_EXPOSED_HEADERS |
By default, none of the headers are exposed in response.
|
static java.lang.String |
DEFAULT_PREFLIGHT_MAXAGE |
By default, time duration to cache pre-flight response is 30 mins.
|
static java.lang.String |
DEFAULT_SUPPORTS_CREDENTIALS |
By default, support credentials is disabled.
|
static java.lang.String |
HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST |
Boolean value, suggesting if the request is a CORS request or not.
|
static java.lang.String |
HTTP_REQUEST_ATTRIBUTE_ORIGIN |
Attribute that contains the origin of the request.
|
static java.lang.String |
HTTP_REQUEST_ATTRIBUTE_PREFIX |
The prefix to a CORS request attribute.
|
static java.lang.String |
HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS |
Request headers sent as 'Access-Control-Request-Headers' header, for
pre-flight request.
|
static java.lang.String |
HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE |
Type of CORS request, of type
CorsFilter.CORSRequestType . |
static java.lang.String |
PARAM_CORS_ALLOWED_HEADERS |
Key to retrieve allowed headers from
FilterConfig . |
static java.lang.String |
PARAM_CORS_ALLOWED_METHODS |
Key to retrieve allowed methods from
FilterConfig . |
static java.lang.String |
PARAM_CORS_ALLOWED_ORIGINS |
Key to retrieve allowed origins from
FilterConfig . |
static java.lang.String |
PARAM_CORS_EXPOSED_HEADERS |
Key to retrieve exposed headers from
FilterConfig . |
static java.lang.String |
PARAM_CORS_PREFLIGHT_MAXAGE |
Key to retrieve preflight max age from
FilterConfig . |
static java.lang.String |
PARAM_CORS_REQUEST_DECORATE |
Key to determine if request should be decorated.
|
static java.lang.String |
PARAM_CORS_SUPPORT_CREDENTIALS |
Key to retrieve support credentials from
FilterConfig . |
static java.lang.String |
REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS |
The Access-Control-Request-Headers header indicates which headers will be
used in the actual request as part of the preflight request.
|
static java.lang.String |
REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD |
The Access-Control-Request-Method header indicates which method will be
used in the actual request as part of the preflight request.
|
static java.lang.String |
REQUEST_HEADER_ORIGIN |
The Origin header indicates where the cross-origin request or preflight
request originates from.
|
static java.lang.String |
REQUEST_HEADER_VARY |
Deprecated.
Unused.
|
static java.lang.String |
RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS |
The Access-Control-Allow-Credentials header indicates whether the
response to request can be exposed when the omit credentials flag is
unset.
|
static java.lang.String |
RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS |
The Access-Control-Allow-Headers header indicates, as part of the
response to a preflight request, which header field names can be used
during the actual request.
|
static java.lang.String |
RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS |
The Access-Control-Allow-Methods header indicates, as part of the
response to a preflight request, which methods can be used during the
actual request.
|
static java.lang.String |
RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN |
The Access-Control-Allow-Origin header indicates whether a resource can
be shared based by returning the value of the Origin request header in
the response.
|
static java.lang.String |
RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS |
The Access-Control-Expose-Headers header indicates which headers are safe
to expose to the API of a CORS API specification
|
static java.lang.String |
RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE |
The Access-Control-Max-Age header indicates how long the results of a
preflight request can be cached in a preflight result cache.
|
static java.util.Collection<java.lang.String> |
SIMPLE_HTTP_REQUEST_CONTENT_TYPE_VALUES |
Collection of media type values for the Content-Type header that
will be treated as 'simple'. |
Constructor | Description |
---|---|
CorsFilter() |
Modifier and Type | Method | Description |
---|---|---|
protected CorsFilter.CORSRequestType |
checkRequestType(HttpServletRequest request) |
Determines the request type.
|
protected static void |
decorateCORSProperties(HttpServletRequest request,
CorsFilter.CORSRequestType corsRequestType) |
Decorates the
HttpServletRequest , with CORS attributes. |
void |
doFilter(ServletRequest servletRequest,
ServletResponse servletResponse,
FilterChain filterChain) |
The
doFilter method of the Filter is called by the container
each time a request/response pair is passed through the chain due to a
client request for a resource at the end of the chain. |
java.util.Collection<java.lang.String> |
getAllowedHttpHeaders() |
Returns a
Set of headers support by resource. |
java.util.Collection<java.lang.String> |
getAllowedHttpMethods() |
Returns a
Set of HTTP methods that are allowed to make requests. |
java.util.Collection<java.lang.String> |
getAllowedOrigins() |
Returns the
Set of allowed origins that are allowed to make
requests. |
java.util.Collection<java.lang.String> |
getExposedHeaders() |
Obtain the headers to expose.
|
long |
getPreflightMaxAge() |
Returns the preflight response cache time in seconds.
|
protected void |
handlePreflightCORS(HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain) |
Handles CORS pre-flight request.
|
protected void |
handleSimpleCORS(HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain) |
Handles a CORS request of type
CorsFilter.CORSRequestType .SIMPLE. |
void |
init() |
Convenience method for sub-classes to save them having to call
super.init(config) . |
boolean |
isAnyOriginAllowed() |
Determines if any origin is allowed to make CORS request.
|
boolean |
isSupportsCredentials() |
Determines is supports credentials is enabled.
|
protected static boolean |
isValidOrigin(java.lang.String origin) |
Checks if a given origin is valid or not.
|
protected static java.lang.String |
join(java.util.Collection<java.lang.String> elements,
java.lang.String joinSeparator) |
Joins elements of
Set into a string, where each element is
separated by the provided separator. |
getFilterConfig, getFilterName, getInitParameter, getInitParameterNames, getServletContext, init
public static final java.lang.String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN
public static final java.lang.String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS
public static final java.lang.String RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS
public static final java.lang.String RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE
public static final java.lang.String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS
public static final java.lang.String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS
@Deprecated public static final java.lang.String REQUEST_HEADER_VARY
public static final java.lang.String REQUEST_HEADER_ORIGIN
public static final java.lang.String REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD
public static final java.lang.String REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS
public static final java.lang.String HTTP_REQUEST_ATTRIBUTE_PREFIX
public static final java.lang.String HTTP_REQUEST_ATTRIBUTE_ORIGIN
public static final java.lang.String HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST
public static final java.lang.String HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE
CorsFilter.CORSRequestType
.public static final java.lang.String HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS
public static final java.util.Collection<java.lang.String> SIMPLE_HTTP_REQUEST_CONTENT_TYPE_VALUES
Collection
of media type values for the Content-Type header that
will be treated as 'simple'. Note media-type values are compared ignoring
parameters and in a case-insensitive manner.public static final java.lang.String DEFAULT_ALLOWED_ORIGINS
public static final java.lang.String DEFAULT_ALLOWED_HTTP_METHODS
public static final java.lang.String DEFAULT_PREFLIGHT_MAXAGE
public static final java.lang.String DEFAULT_SUPPORTS_CREDENTIALS
public static final java.lang.String DEFAULT_ALLOWED_HTTP_HEADERS
public static final java.lang.String DEFAULT_EXPOSED_HEADERS
public static final java.lang.String DEFAULT_DECORATE_REQUEST
public static final java.lang.String PARAM_CORS_ALLOWED_ORIGINS
FilterConfig
.public static final java.lang.String PARAM_CORS_SUPPORT_CREDENTIALS
FilterConfig
.public static final java.lang.String PARAM_CORS_EXPOSED_HEADERS
FilterConfig
.public static final java.lang.String PARAM_CORS_ALLOWED_HEADERS
FilterConfig
.public static final java.lang.String PARAM_CORS_ALLOWED_METHODS
FilterConfig
.public static final java.lang.String PARAM_CORS_PREFLIGHT_MAXAGE
FilterConfig
.public static final java.lang.String PARAM_CORS_REQUEST_DECORATE
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws java.io.IOException, ServletException
javax.servlet.Filter
doFilter
method of the Filter is called by the container
each time a request/response pair is passed through the chain due to a
client request for a resource at the end of the chain. The FilterChain
passed in to this method allows the Filter to pass on the request and
response to the next entity in the chain.
A typical implementation of this method would follow the following
pattern:-
1. Examine the request
2. Optionally wrap the request object with a custom implementation to
filter content or headers for input filtering
3. Optionally wrap the response object with a custom implementation to
filter content or headers for output filtering
4. a) Either invoke the next entity in the chain using
the FilterChain object (chain.doFilter()
),
4. b) or not pass on the request/response pair to the
next entity in the filter chain to block the request processing
5. Directly set headers on the response after invocation of the next
entity in the filter chain.
servletRequest
- The request to processservletResponse
- The response associated with the requestfilterChain
- Provides access to the next filter in the chain for this
filter to pass the request and response to for further
processingjava.io.IOException
- if an I/O error occurs during this filter's
processing of the requestServletException
- if the processing fails for any other reasonpublic void init() throws ServletException
javax.servlet.GenericFilter
super.init(config)
. This is a NO-OP by default.init
in class GenericFilter
ServletException
- If an exception occurs that interrupts the
Filter's normal operationprotected void handleSimpleCORS(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws java.io.IOException, ServletException
CorsFilter.CORSRequestType
.SIMPLE.request
- The HttpServletRequest
object.response
- The HttpServletResponse
object.filterChain
- The FilterChain
object.java.io.IOException
- an IO error occurredServletException
- Servlet error propagationprotected void handlePreflightCORS(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws java.io.IOException, ServletException
request
- The HttpServletRequest
object.response
- The HttpServletResponse
object.filterChain
- The FilterChain
object.java.io.IOException
- an IO error occurredServletException
- Servlet error propagationprotected static void decorateCORSProperties(HttpServletRequest request, CorsFilter.CORSRequestType corsRequestType)
HttpServletRequest
, with CORS attributes.
true
if CORS request; false
otherwise.simple
or preflight
or not_cors
or
invalid_cors
request
- The HttpServletRequest
object.corsRequestType
- The CorsFilter.CORSRequestType
object.protected static java.lang.String join(java.util.Collection<java.lang.String> elements, java.lang.String joinSeparator)
Set
into a string, where each element is
separated by the provided separator.elements
- The Set
containing elements to join together.joinSeparator
- The character to be used for separating elements.String
; null
if elements
Set
is null.protected CorsFilter.CORSRequestType checkRequestType(HttpServletRequest request)
request
- The HTTP Servlet requestprotected static boolean isValidOrigin(java.lang.String origin)
URI
origin
- The origin URItrue
if the origin was validpublic boolean isAnyOriginAllowed()
true
if it's enabled; false otherwise.public java.util.Collection<java.lang.String> getExposedHeaders()
public boolean isSupportsCredentials()
true
if the use of credentials is supported
otherwise false
public long getPreflightMaxAge()
public java.util.Collection<java.lang.String> getAllowedOrigins()
Set
of allowed origins that are allowed to make
requests.Set
public java.util.Collection<java.lang.String> getAllowedHttpMethods()
Set
of HTTP methods that are allowed to make requests.Set
public java.util.Collection<java.lang.String> getAllowedHttpHeaders()
Set
of headers support by resource.Set
Copyright © 2000-2019 Apache Software Foundation. All Rights Reserved.