io.micronaut.http.server.cors

Class CorsFilter

java.lang.Object

io.micronaut.http.server.cors.CorsFilter

All Implemented Interfaces:

Ordered, HttpFilter, HttpServerFilter

@Filter(value="/**")
public class CorsFilter
extends Object
implements HttpServerFilter

Responsible for handling CORS requests and responses.

Since:

1.0

Author:

James Kleeh, Graeme Rocher

Field Summary

Fields

Modifier and Type	Field and Description
protected HttpServerConfiguration.CorsConfiguration	corsConfiguration

Fields inherited from interface io.micronaut.core.order.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

Constructors

Constructor and Description
CorsFilter(HttpServerConfiguration.CorsConfiguration corsConfiguration) Deprecated. Use CorsFilter(HttpServerConfiguration.CorsConfiguration, HttpHostResolver) instead.
CorsFilter(HttpServerConfiguration.CorsConfiguration corsConfiguration, HttpHostResolver httpHostResolver)

Method Summary

Modifier and Type	Method and Description
Publisher<MutableHttpResponse<?>>	doFilter(HttpRequest<?> request, ServerFilterChain chain) Variation of the HttpServerFilter.doFilter(HttpRequest, FilterChain) method that accepts a ServerFilterChain which allows to mutate the outgoing HTTP response.
int	getOrder()
protected Optional<MutableHttpResponse<?>>	handleRequest(HttpRequest request) Deprecated. Not used any more.
protected void	handleResponse(HttpRequest<?> request, MutableHttpResponse<?> response) Deprecated. not used
protected void	setAllowCredentials(CorsOriginConfiguration config, MutableHttpResponse<?> response)
protected void	setAllowHeaders(List<?> optionalAllowHeaders, MutableHttpResponse<?> response)
protected void	setAllowMethods(HttpMethod method, MutableHttpResponse<?> response)
protected void	setExposeHeaders(List<String> exposedHeaders, MutableHttpResponse<?> response)
protected void	setMaxAge(long maxAge, MutableHttpResponse<?> response)
protected void	setOrigin(String origin, MutableHttpResponse<?> response)
protected void	setVary(MutableHttpResponse<?> response)
protected boolean	shouldDenyToPreventDriveByLocalhostAttack(CorsOriginConfiguration corsOriginConfiguration, HttpRequest<?> request)
protected boolean	shouldDenyToPreventDriveByLocalhostAttack(String origin, HttpRequest<?> request)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface io.micronaut.http.filter.HttpServerFilter

doFilter

Field Detail

corsConfiguration

protected final HttpServerConfiguration.CorsConfiguration corsConfiguration

Constructor Detail

CorsFilter

@Inject
public CorsFilter(HttpServerConfiguration.CorsConfiguration corsConfiguration,
                          @Nullable
                          HttpHostResolver httpHostResolver)

Parameters:

corsConfiguration - The CorsOriginConfiguration instance

httpHostResolver - HTTP Host resolver

CorsFilter

@Deprecated
public CorsFilter(HttpServerConfiguration.CorsConfiguration corsConfiguration)

Deprecated. Use CorsFilter(HttpServerConfiguration.CorsConfiguration, HttpHostResolver) instead.

Parameters:

corsConfiguration - The CorsOriginConfiguration instance

Method Detail

doFilter

public Publisher<MutableHttpResponse<?>> doFilter(HttpRequest<?> request,
                                                  ServerFilterChain chain)

Description copied from interface: HttpServerFilter

Variation of the HttpServerFilter.doFilter(HttpRequest, FilterChain) method that accepts a ServerFilterChain which allows to mutate the outgoing HTTP response.

Specified by:

doFilter in interface HttpServerFilter

Parameters:

request - The request

chain - The chain

Returns:

A Publisher that emits a MutableHttpResponse

See Also:

HttpServerFilter.doFilter(HttpRequest, FilterChain)

shouldDenyToPreventDriveByLocalhostAttack

protected boolean shouldDenyToPreventDriveByLocalhostAttack(@NonNull
                                                            CorsOriginConfiguration corsOriginConfiguration,
                                                            @NonNull
                                                            HttpRequest<?> request)

Parameters:

corsOriginConfiguration - CORS Origin configuration for request's HTTP Header origin.

request - HTTP Request

Returns:

true if the resolved host is localhost or 127.0.0.1 address and the CORS configuration has any for allowed origins.

shouldDenyToPreventDriveByLocalhostAttack

protected boolean shouldDenyToPreventDriveByLocalhostAttack(@NonNull
                                                            String origin,
                                                            @NonNull
                                                            HttpRequest<?> request)

Parameters:

origin - HTTP Header HttpHeaders.ORIGIN value.

request - HTTP Request

Returns:

true if the resolved host is localhost or 127.0.0.1 and origin is not one of these then deny it.

getOrder

public int getOrder()

Specified by:

getOrder in interface Ordered

Returns:

The order of the object. Defaults to zero (no order).

handleResponse

@Deprecated
protected void handleResponse(HttpRequest<?> request,
                                          MutableHttpResponse<?> response)

Deprecated. not used

Handles a CORS response.

Parameters:

request - The HttpRequest object

response - The MutableHttpResponse object

handleRequest

@Deprecated
protected Optional<MutableHttpResponse<?>> handleRequest(HttpRequest request)

Deprecated. Not used any more.

Handles a CORS HttpRequest.

Parameters:

request - The HttpRequest object

Returns:

An optional MutableHttpResponse. The request should proceed normally if empty

setAllowCredentials

protected void setAllowCredentials(CorsOriginConfiguration config,
                                   MutableHttpResponse<?> response)

Parameters:

config - The CorsOriginConfiguration instance

response - The MutableHttpResponse object

setExposeHeaders

protected void setExposeHeaders(List<String> exposedHeaders,
                                MutableHttpResponse<?> response)

Parameters:

exposedHeaders - A list of the exposed headers

response - The MutableHttpResponse object

setVary

protected void setVary(MutableHttpResponse<?> response)

Parameters:

response - The MutableHttpResponse object

setOrigin

protected void setOrigin(@Nullable
                         String origin,
                         @NonNull
                         MutableHttpResponse<?> response)

Parameters:

origin - The origin

response - The MutableHttpResponse object

setAllowMethods

protected void setAllowMethods(HttpMethod method,
                               MutableHttpResponse<?> response)

Parameters:

method - The HttpMethod object

response - The MutableHttpResponse object

setAllowHeaders

protected void setAllowHeaders(List<?> optionalAllowHeaders,
                               MutableHttpResponse<?> response)

Parameters:

optionalAllowHeaders - A list with optional allow headers

response - The MutableHttpResponse object

setMaxAge

protected void setMaxAge(long maxAge,
                         MutableHttpResponse<?> response)

Parameters:

maxAge - The max age

response - The MutableHttpResponse object