45 lines
1.7 KiB
Plaintext
45 lines
1.7 KiB
Plaintext
==============================================================================
|
|
docs/output/06-two-sources.txt
|
|
Two UrlBasedCorsConfigurationSource beans. The reference documentation says Spring Security
|
|
'won't automatically configure CORS support for you, because it cannot decide which one to
|
|
use'. In 7.1.1 it configures it, and the bean NAME decides.
|
|
Profile: twosources
|
|
==============================================================================
|
|
|
|
{
|
|
"corsConfigurationSourceBeans": {
|
|
"corsConfigurationSource": "UrlBasedCorsConfigurationSource",
|
|
"adminCorsSource": "UrlBasedCorsConfigurationSource",
|
|
"mvcHandlerMappingIntrospector": "HandlerMappingIntrospector"
|
|
},
|
|
"hasBeanNamedCorsConfigurationSource": true
|
|
}
|
|
|
|
# the origin allowed by the bean named corsConfigurationSource:
|
|
HTTP/1.1 200
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
Access-Control-Allow-Origin: https://spa.example.com
|
|
Access-Control-Allow-Methods: GET,POST
|
|
Access-Control-Allow-Headers: content-type
|
|
Access-Control-Allow-Credentials: true
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
# the origin allowed by adminCorsSource, which is never consulted:
|
|
HTTP/1.1 403
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
<timestamp> DEBUG <pid> --- [cors-csrf-samesite] [nio-8080-exec-N] o.s.web.cors.DefaultCorsProcessor : Reject: 'https://admin.example.com' origin is not allowed
|