I am using Spring Boot v1.5.1, and it seems my restriction on CORS origin is not working.
My application.properties file has the following line (ref1 ref2).
endpoints.cors.allowed-origins=http://mydomain.io
My REST controller looks like the following.
@RestController
@CrossOrigin
@RequestMapping("/api/car")
public class CarCtrl {
@Autowired
private CarService carService;
@GetMapping
public Car get() {
return carService.getLatest();
}
}
However, when I open up a browser and type in http://localhost:8080/api/car I am still able to access the REST endpoint.
I also tried to change my annotation as follows, but that does not work.
@CrossOrigin("${endpoints.cors.allowed-origins}")
Any ideas on what I'm doing wrong?
Note that I am not using WebMvcConfigurerAdapter like this post. Do I really need to extends this class to explicitly control origin? I figured that the @CrossOrigin annotation in addition to the properties file setting would be able to control the allowed origins (as opposed to having to do so programmatically).
However, when I open up a browser and type in http://localhost:8080/api/car I am still able to access the REST endpoint.
CORS allowed-origins settings won’t prevent you from opening the URL directly in a browser.
Browsers only impose CORS restrictions on JavaScript code running in web apps that use XHR or Fetch or jQuery $.ajax(…) or whatever to make cross-origin requests.
So CORS isn’t a way to prevent users from being able to directly navigate to a URL, and isn’t a way to prevent non-webapp clients like curl or Postman or whatever from accessing the URL.
Explicitly specifying the domain as string in @CrossOrigin("http://mydomain.io") will work. I dont' think this will work @CrossOrigin("${endpoints.cors.allowed-origins}").
As for me I am adding s CrossRef Filter on my apps.
package com.alexfrndz.filter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.GenericFilterBean;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
public class SimpleCORSFilter extends GenericFilterBean {
/**
* The Logger for this class.
*/
private final Logger logger = LoggerFactory.getLogger(this.getClass());
@Override
public void doFilter(ServletRequest req, ServletResponse resp,
FilterChain chain) throws IOException, ServletException {
HttpServletResponse response = (HttpServletResponse) resp;
response.setHeader("Access-Control-Allow-Origin", "*");
response.setHeader("Access-Control-Allow-Methods", "POST, PUT, GET, OPTIONS, DELETE");
response.setHeader("Access-Control-Max-Age", "3600");
response.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type");
//response.setHeader("Access-Control-Allow-Credentials", "true");
chain.doFilter(req, resp);
}
}
