-
Notifications
You must be signed in to change notification settings - Fork 38.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for pattern based origin cors configuration #25016
Support for pattern based origin cors configuration #25016
Conversation
More tests added. Closes spring-projectsgh-24763
More tests added. Combininig CorsConfiguration fixed. Closes spring-projectsgh-24763
More tests added. Combininig CorsConfiguration fixed. Closes spring-projectsgh-24763
@sdeleuze @rstoyanchev can you review please? |
# Conflicts: # spring-webmvc/src/test/java/org/springframework/web/servlet/handler/CorsAbstractHandlerMappingTests.java # spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/CrossOriginTests.java
More tests added. Combininig CorsConfiguration fixed. Closes spring-projectsgh-24763
@korektur, on a first pass this looks okay to me and I can take it from here. One thing I'd like to refine is the pattern syntax to be just wildcards, as in your original #24763 (comment) Note also that typically it is better to rebase your PR rather than doing merges. I have corrected that locally, so please don't make any further changes. |
@rstoyanchev yes, that makes sense. |
@korektur curious if this is now available. Couldn't find any documentation for this |
@bb-deepak yes it's available. You can find documentation here for example: https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/cors/CorsConfiguration.html#setAllowedOriginPatterns-java.util.List- |
thank you, it's indeed mentioned in the spring cors config docs, instead of mentioned as a configurable property in spring cloud gateway docs example hence a bit difficult to find - https://cloud.spring.io/spring-cloud-gateway/reference/html/#cors-configuration |
Can someone for the stupid explain why this violates CORS specs with "*" and |
Fix #24763
I have modified
CorsConfiguration
to support pattern based origins.Obviously that can be done in a different ways, like using somehing else instead of standard java
Pattern
or creating a new delegatePatternCorsConfiguration
instead of modifying existing one, so please let me know if the approach I've chosen is not the most suitable.