Skip to content

Instantly share code, notes, and snippets.

@jeedy
Forked from wildoctopus/CORS Filter
Created February 25, 2020 02:17
Show Gist options
  • Save jeedy/8f4c891b83dc9773b4c26a7afe275874 to your computer and use it in GitHub Desktop.
Save jeedy/8f4c891b83dc9773b4c26a7afe275874 to your computer and use it in GitHub Desktop.
How to fix the CORS issue on backend side , java Springboot App (Handling Simple CORS requests)
//Contents from https://spring.io/understanding/CORS
In the simplest scenario, cross-origin communications starts with a client making a GET, POST, or HEAD request against a resource on the server.
In this scenario, the content type of a POST request is limited to application/x-www-form-urlencoded, multipart/form-data, or text/plain. The request includes an Origin header that indicates the origin of the client code.
The server will consider the request's Origin and either allow or disallow the request. If the server allows the request, then it will respond with the requested resource and an Access-Control-Allow-Origin header in the response. This header will indicate to the client which client origins will be allowed to access the resource. Assuming that the Access-Control-Allow-Origin header matches the request's Origin, the browser will allow the request.
On the other hand, if Access-Control-Allow-Origin is missing in the response or if it doesn't match the request's Origin, the browser will disallow the request.
Two simple ways discussed below to handle this Access-Control-Allow-Origin (CORS) issue -
1) Put @CrossOrigin annotation on top of Controller to allow CORS as shown below-
@CrossOrigin(origins= {"*"}, maxAge = 4800, allowCredentials = "false" )
@RestController
@RequestMapping("/")
public class XYZ {
/* put your code here */
}
2) A simple ways is to create a simple CORS filter to allow every type pf CORS, this can be done as shown below.
//Samle code - for full code download the file SimpleCORSFilter
@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
response.setHeader("Access-Control-Max-Age", "3600");
response.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me");
chain.doFilter(req, res);
}
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Component;
@Component
public class SimpleCORSFilter implements Filter {
private final Logger log = LoggerFactory.getLogger(SimpleCORSFilter.class);
public SimpleCORSFilter() {
log.info("SimpleCORSFilter init");
}
@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
response.setHeader("Access-Control-Max-Age", "3600");
response.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me");
chain.doFilter(req, res);
}
@Override
public void init(FilterConfig filterConfig) {
}
@Override
public void destroy() {
}
}
@jeedy
Copy link
Author

jeedy commented Feb 25, 2020

Access-Control-Allow-Origin 값을 와일드카드 "*"를 사용하는 것은 PCI-DSS 심사 크로스도메인 관련에서 불합격 사유가 된다.
명시적으로 호출한 도메인 (origin 도메인) 주소를 입력해서 해결 할 수 있다.

자세한 내용은
https://developer.mozilla.org/ko/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment