@Component public final class CorsFilter extends Object implements javax.servlet.Filter
| 限定符和类型 | 类和说明 |
|---|---|
protected static class |
CorsFilter.CORSRequestType
Enumerates varies types of CORS requests.
|
| 限定符和类型 | 字段和说明 |
|---|---|
static Collection<String> |
COMPLEX_HTTP_METHODS
Collection of non-simple HTTP methods. |
static String |
DEFAULT_ALLOWED_HTTP_HEADERS
By default, following headers are supported:
Origin,Accept,X-Requested-With, Content-Type,
Access-Control-Request-Method, and Access-Control-Request-Headers.
|
static String |
DEFAULT_ALLOWED_HTTP_METHODS
By default, following methods are supported: GET, POST, HEAD and OPTIONS.
|
static String |
DEFAULT_ALLOWED_ORIGINS
By default, all origins are allowed to make requests.
|
static String |
DEFAULT_DECORATE_REQUEST
By default, request is decorated with CORS attributes.
|
static String |
DEFAULT_EXPOSED_HEADERS
By default, none of the headers are exposed in response.
|
static String |
DEFAULT_PREFLIGHT_MAXAGE
By default, time duration to cache pre-flight response is 30 mins.
|
static String |
DEFAULT_SUPPORTS_CREDENTIALS
By default, support credentials is turned on.
|
static Collection<String> |
HTTP_METHODS
Collection of HTTP methods. |
static String |
HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST
Boolean value, suggesting if the request is a CORS request or not.
|
static String |
HTTP_REQUEST_ATTRIBUTE_ORIGIN
Attribute that contains the origin of the request.
|
static String |
HTTP_REQUEST_ATTRIBUTE_PREFIX
The prefix to a CORS request attribute.
|
static String |
HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS
Request headers sent as 'Access-Control-Request-Headers' header, for
pre-flight request.
|
static String |
HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE
Type of CORS request, of type
CorsFilter.CORSRequestType. |
static String |
PARAM_CORS_ALLOWED_HEADERS
Key to retrieve allowed headers from
FilterConfig. |
static String |
PARAM_CORS_ALLOWED_METHODS
Key to retrieve allowed methods from
FilterConfig. |
static String |
PARAM_CORS_ALLOWED_ORIGINS
Key to retrieve allowed origins from
FilterConfig. |
static String |
PARAM_CORS_EXPOSED_HEADERS
Key to retrieve exposed headers from
FilterConfig. |
static String |
PARAM_CORS_PREFLIGHT_MAXAGE
Key to retrieve preflight max age from
FilterConfig. |
static String |
PARAM_CORS_REQUEST_DECORATE
Key to determine if request should be decorated.
|
static String |
PARAM_CORS_SUPPORT_CREDENTIALS
Key to retrieve support credentials from
FilterConfig. |
static String |
REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS
The Access-Control-Request-Headers header indicates which headers will be
used in the actual request as part of the preflight request.
|
static String |
REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD
The Access-Control-Request-Method header indicates which method will be
used in the actual request as part of the preflight request.
|
static String |
REQUEST_HEADER_ORIGIN
The Origin header indicates where the cross-origin request or preflight
request originates from.
|
static String |
RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS
The Access-Control-Allow-Credentials header indicates whether the
response to request can be exposed when the omit credentials flag is
unset.
|
static String |
RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS
The Access-Control-Allow-Headers header indicates, as part of the
response to a preflight request, which header field names can be used
during the actual request.
|
static String |
RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS
The Access-Control-Allow-Methods header indicates, as part of the
response to a preflight request, which methods can be used during the
actual request.
|
static String |
RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN
The Access-Control-Allow-Origin header indicates whether a resource can
be shared based by returning the value of the Origin request header in
the response.
|
static String |
RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS
The Access-Control-Expose-Headers header indicates which headers are safe
to expose to the API of a CORS API specification
|
static String |
RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE
The Access-Control-Max-Age header indicates how long the results of a
preflight request can be cached in a preflight result cache.
|
static Collection<String> |
SIMPLE_HTTP_METHODS
Collection of Simple HTTP methods. |
static Collection<String> |
SIMPLE_HTTP_REQUEST_CONTENT_TYPE_VALUES
Collection of Simple HTTP request headers. |
static Collection<String> |
SIMPLE_HTTP_REQUEST_HEADERS
Collection of Simple HTTP request headers. |
static Collection<String> |
SIMPLE_HTTP_RESPONSE_HEADERS
Collection of Simple HTTP request headers. |
| 构造器和说明 |
|---|
CorsFilter() |
| 限定符和类型 | 方法和说明 |
|---|---|
protected CorsFilter.CORSRequestType |
checkRequestType(javax.servlet.http.HttpServletRequest request)
Determines the request type.
|
protected static void |
decorateCORSProperties(javax.servlet.http.HttpServletRequest request,
CorsFilter.CORSRequestType corsRequestType)
Decorates the
HttpServletRequest, with CORS attributes. |
void |
destroy() |
void |
doFilter(javax.servlet.ServletRequest servletRequest,
javax.servlet.ServletResponse servletResponse,
javax.servlet.FilterChain filterChain) |
Collection<String> |
getAllowedHttpHeaders()
Returns a
Set of headers support by resource. |
Collection<String> |
getAllowedHttpMethods()
Returns a
Set of HTTP methods that are allowed to make requests. |
Collection<String> |
getAllowedOrigins()
Returns the
Set of allowed origins that are allowed to make
requests. |
Collection<String> |
getExposedHeaders()
Returns a
Set of headers that should be exposed by browser. |
long |
getPreflightMaxAge()
Returns the preflight response cache time in seconds.
|
protected void |
handlePreflightCORS(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
javax.servlet.FilterChain filterChain)
Handles CORS pre-flight request.
|
protected void |
handleSimpleCORS(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
javax.servlet.FilterChain filterChain)
Handles a CORS request of type
CorsFilter.CORSRequestType.SIMPLE. |
void |
init(javax.servlet.FilterConfig filterConfig) |
boolean |
isAnyOriginAllowed()
Determines if any origin is allowed to make CORS request.
|
boolean |
isSupportsCredentials()
Determines is supports credentials is enabled.
|
protected static boolean |
isValidOrigin(String origin)
Checks if a given origin is valid or not.
|
protected static String |
join(Collection<String> elements,
String joinSeparator)
Joins elements of
Set into a string, where each element is
separated by the provided separator. |
public static final String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN
public static final String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS
public static final String RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS
public static final String RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE
public static final String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS
public static final String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS
public static final String REQUEST_HEADER_ORIGIN
public static final String REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD
public static final String REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS
public static final String HTTP_REQUEST_ATTRIBUTE_PREFIX
public static final String HTTP_REQUEST_ATTRIBUTE_ORIGIN
public static final String HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST
public static final String HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE
CorsFilter.CORSRequestType.public static final String HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS
public static final Collection<String> HTTP_METHODS
Collection of HTTP methods. Case sensitive.public static final Collection<String> COMPLEX_HTTP_METHODS
Collection of non-simple HTTP methods. Case sensitive.public static final Collection<String> SIMPLE_HTTP_METHODS
Collection of Simple HTTP methods. Case sensitive.public static final Collection<String> SIMPLE_HTTP_REQUEST_HEADERS
Collection of Simple HTTP request headers. Case in-sensitive.public static final Collection<String> SIMPLE_HTTP_RESPONSE_HEADERS
Collection of Simple HTTP request headers. Case in-sensitive.public static final Collection<String> SIMPLE_HTTP_REQUEST_CONTENT_TYPE_VALUES
Collection of Simple HTTP request headers. Case in-sensitive.public static final String DEFAULT_ALLOWED_ORIGINS
public static final String DEFAULT_ALLOWED_HTTP_METHODS
public static final String DEFAULT_PREFLIGHT_MAXAGE
public static final String DEFAULT_SUPPORTS_CREDENTIALS
public static final String DEFAULT_ALLOWED_HTTP_HEADERS
public static final String DEFAULT_EXPOSED_HEADERS
public static final String DEFAULT_DECORATE_REQUEST
public static final String PARAM_CORS_ALLOWED_ORIGINS
FilterConfig.public static final String PARAM_CORS_SUPPORT_CREDENTIALS
FilterConfig.public static final String PARAM_CORS_EXPOSED_HEADERS
FilterConfig.public static final String PARAM_CORS_ALLOWED_HEADERS
FilterConfig.public static final String PARAM_CORS_ALLOWED_METHODS
FilterConfig.public static final String PARAM_CORS_PREFLIGHT_MAXAGE
FilterConfig.public void doFilter(javax.servlet.ServletRequest servletRequest,
javax.servlet.ServletResponse servletResponse,
javax.servlet.FilterChain filterChain)
throws IOException,
javax.servlet.ServletException
doFilter 在接口中 javax.servlet.FilterIOExceptionjavax.servlet.ServletExceptionpublic void init(javax.servlet.FilterConfig filterConfig)
throws javax.servlet.ServletException
init 在接口中 javax.servlet.Filterjavax.servlet.ServletExceptionprotected void handleSimpleCORS(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
javax.servlet.FilterChain filterChain)
throws IOException,
javax.servlet.ServletException
CorsFilter.CORSRequestType.SIMPLE.request - The HttpServletRequest object.response - The HttpServletResponse object.filterChain - The FilterChain object.IOExceptionjavax.servlet.ServletExceptionprotected void handlePreflightCORS(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
javax.servlet.FilterChain filterChain)
throws IOException,
javax.servlet.ServletException
request - The HttpServletRequest object.response - The HttpServletResponse object.filterChain - The FilterChain object.IOExceptionjavax.servlet.ServletExceptionpublic void destroy()
destroy 在接口中 javax.servlet.Filterprotected static void decorateCORSProperties(javax.servlet.http.HttpServletRequest request,
CorsFilter.CORSRequestType corsRequestType)
HttpServletRequest, with CORS attributes.
true if CORS request; false
otherwise.simple or preflight or not_cors or
invalid_corsrequest - The HttpServletRequest object.corsRequestType - The CorsFilter.CORSRequestType object.protected static String join(Collection<String> elements, String joinSeparator)
Set into a string, where each element is
separated by the provided separator.protected CorsFilter.CORSRequestType checkRequestType(javax.servlet.http.HttpServletRequest request)
request - protected static boolean isValidOrigin(String origin)
URIorigin - public boolean isAnyOriginAllowed()
true if it's enabled; false otherwise.public Collection<String> getExposedHeaders()
Set of headers that should be exposed by browser.public boolean isSupportsCredentials()
public long getPreflightMaxAge()
public Collection<String> getAllowedOrigins()
Set of allowed origins that are allowed to make
requests.Setpublic Collection<String> getAllowedHttpMethods()
Set of HTTP methods that are allowed to make requests.Setpublic Collection<String> getAllowedHttpHeaders()
Set of headers support by resource.SetCopyright © 2013–2014 Shark Xu. All rights reserved.