Package io.micronaut.http.server.cors

Class CorsFilter

java.lang.Object
io.micronaut.http.server.cors.CorsFilter
All Implemented Interfaces:
io.micronaut.core.order.Ordered, io.micronaut.http.filter.ConditionalFilter
@ServerFilter("/**") public class CorsFilter extends Object implements io.micronaut.core.order.Ordered, io.micronaut.http.filter.ConditionalFilter
Responsible for handling CORS requests and responses.
Since:
1.0

  • Field Details

  • Constructor Details

  • Method Details

    • isEnabled

      public boolean isEnabled(io.micronaut.http.HttpRequest<?> request)
      Specified by:
      isEnabled in interface io.micronaut.http.filter.ConditionalFilter

    • filterRequest

      @RequestFilter @Nullable @Internal public final @Nullable io.micronaut.http.HttpResponse<?> filterRequest(io.micronaut.http.HttpRequest<?> request)

    • filterResponse

      @ResponseFilter @Internal public final void filterResponse(io.micronaut.http.HttpRequest<?> request, io.micronaut.http.MutableHttpResponse<?> response)

    • shouldDenyToPreventDriveByLocalhostAttack

      protected boolean shouldDenyToPreventDriveByLocalhostAttack(@NonNull @NonNull CorsOriginConfiguration corsOriginConfiguration, @NonNull @NonNull io.micronaut.http.HttpRequest<?> request)
      Parameters:
      corsOriginConfiguration - CORS Origin configuration for request's HTTP Header origin.
      request - HTTP Request
      Returns:
      true if the resolved host is localhost or 127.0.0.1 address and the CORS configuration has any for allowed origins.

    • shouldDenyToPreventDriveByLocalhostAttack

      protected boolean shouldDenyToPreventDriveByLocalhostAttack(@NonNull @NonNull String origin, @NonNull @NonNull io.micronaut.http.HttpRequest<?> request)
      Parameters:
      origin - HTTP Header HttpHeaders.ORIGIN value.
      request - HTTP Request
      Returns:
      true if the resolved host is localhost or 127.0.0.1 and origin is not one of these then deny it.

    • getOrder

      public int getOrder()
      Specified by:
      getOrder in interface io.micronaut.core.order.Ordered

    • setAllowCredentials

      protected void setAllowCredentials(CorsOriginConfiguration config, io.micronaut.http.MutableHttpResponse<?> response)
      Parameters:
      config - The CorsOriginConfiguration instance
      response - The MutableHttpResponse object

    • setAllowPrivateNetwork

      protected void setAllowPrivateNetwork(CorsOriginConfiguration config, io.micronaut.http.MutableHttpResponse<?> response)
      Sets the HTTP Header "Access-Control-Allow-Private-Network" in the response to true, if the CorsOriginConfiguration.isAllowPrivateNetwork() is true.
      Parameters:
      config - The CorsOriginConfiguration instance
      response - The MutableHttpResponse object

    • setExposeHeaders

      protected void setExposeHeaders(List<String> exposedHeaders, io.micronaut.http.MutableHttpResponse<?> response)
      Parameters:
      exposedHeaders - A list of the exposed headers
      response - The MutableHttpResponse object

    • setVary

      protected void setVary(io.micronaut.http.MutableHttpResponse<?> response)
      Parameters:
      response - The MutableHttpResponse object

    • setOrigin

      protected void setOrigin(@Nullable @Nullable String origin, @NonNull @NonNull io.micronaut.http.MutableHttpResponse<?> response)
      Parameters:
      origin - The origin
      response - The MutableHttpResponse object

    • setAllowMethods

      protected void setAllowMethods(io.micronaut.http.HttpMethod method, io.micronaut.http.MutableHttpResponse<?> response)
      Parameters:
      method - The HttpMethod object
      response - The MutableHttpResponse object

    • setAllowHeaders

      protected void setAllowHeaders(List<?> optionalAllowHeaders, io.micronaut.http.MutableHttpResponse<?> response)
      Parameters:
      optionalAllowHeaders - A list with optional allow headers
      response - The MutableHttpResponse object

    • setMaxAge

      protected void setMaxAge(long maxAge, io.micronaut.http.MutableHttpResponse<?> response)
      Parameters:
      maxAge - The max age
      response - The MutableHttpResponse object