public class Cors extends Object
Cross-origin resource sharing (CORS) is a mechanism that allows restricted resources (e.g. fonts, JavaScript, etc.) on a web page to be requested from another domain outside the domain from which the resource originated.
This class represent the available options for configure CORS in Jooby.
{ decorator(new CorsHandler()); }
Previous example, adds a cors filter using the default cors options.
Modifier and Type | Method and Description |
---|---|
boolean |
allowHeader(String... headers)
True if all the headers are allowed.
|
boolean |
allowHeaders(List<String> headers)
True if all the headers are allowed.
|
boolean |
allowMethod(String method)
True if the method is allowed.
|
boolean |
allowOrigin(String origin)
Test if the given origin is allowed or not.
|
boolean |
anyHeader() |
boolean |
anyOrigin() |
static Cors |
from(com.typesafe.config.Config conf)
Get cors options from application configuration file.
|
List<String> |
getExposedHeaders() |
List<String> |
getHeaders() |
Duration |
getMaxAge() |
List<String> |
getMethods() |
List<String> |
getOrigin()
An origin must be a "*" (any origin), a domain name (like, http://foo.com) and/or a regex
(like, http://*.domain.com).
|
boolean |
getUseCredentials()
If true, set the
Access-Control-Allow-Credentials header. |
Cors |
setExposedHeaders(List<String> exposedHeaders)
Set the list of exposed headers.
|
Cors |
setExposedHeaders(String... exposedHeaders)
Set the list of exposed headers.
|
Cors |
setHeaders(List<String> headers)
Set one or more allowed headers.
|
Cors |
setHeaders(String... headers)
Set one or more allowed headers.
|
Cors |
setMaxAge(Duration preflightMaxAge)
Set the preflight max age header.
|
Cors |
setMethods(List<String> methods)
Set one or more allowed methods.
|
Cors |
setMethods(String... methods)
Set one or more allowed methods.
|
Cors |
setOrigin(List<String> origin)
Set the allowed origins.
|
Cors |
setOrigin(String... origin)
Set the allowed origins.
|
Cors |
setUseCredentials(boolean credentials)
If true, set the
Access-Control-Allow-Credentials header. |
public Cors()
Cors
. Default options are:
origin: "*" credentials: true allowedMethods: [GET, POST] allowedHeaders: [X-Requested-With, Content-Type, Accept, Origin] maxAge: 30m exposedHeaders: []
public boolean getUseCredentials()
Access-Control-Allow-Credentials
header.Access-Control-Allow-Credentials
header must be set.public Cors setUseCredentials(boolean credentials)
Access-Control-Allow-Credentials
header.credentials
- Credentials.public boolean anyOrigin()
public List<String> getOrigin()
*
public boolean allowOrigin(String origin)
origin
- The origin to test.public Cors setOrigin(String... origin)
origin
- One ore more origin.public Cors setOrigin(List<String> origin)
origin
- One ore more origin.public boolean allowMethod(String method)
method
- Method to test.public Cors setMethods(String... methods)
methods
- One or more method.public Cors setMethods(List<String> methods)
methods
- One or more method.public boolean anyHeader()
*
.public boolean allowHeader(String... headers)
headers
- Headers to test.public boolean allowHeaders(List<String> headers)
headers
- Headers to test.public List<String> getHeaders()
X-Requested-With
,
Content-Type
, Accept
and Origin
.public Cors setHeaders(String... headers)
*
if any
header is allowed.headers
- Headers to set.public Cors setHeaders(List<String> headers)
*
if any
header is allowed.headers
- Headers to set.public Cors setExposedHeaders(String... exposedHeaders)
exposedHeaders
- Headers to expose.public Cors setExposedHeaders(List<String> exposedHeaders)
exposedHeaders
- Headers to expose.public Duration getMaxAge()
public Cors setMaxAge(Duration preflightMaxAge)
preflightMaxAge
- Number of seconds or -1
to turn this off.Copyright © 2020. All rights reserved.