37 lines
1.4 KiB
Plaintext
37 lines
1.4 KiB
Plaintext
==============================================================================
|
|
docs/output/03-security-source.txt
|
|
A @Bean named corsConfigurationSource. .cors(..) is never called - it is applied for us.
|
|
Profile: securitysource
|
|
==============================================================================
|
|
|
|
$ curl -s localhost:8080/diag/cors-sources
|
|
{
|
|
"corsConfigurationSourceBeans": {
|
|
"corsConfigurationSource": "UrlBasedCorsConfigurationSource",
|
|
"mvcHandlerMappingIntrospector": "HandlerMappingIntrospector"
|
|
},
|
|
"hasBeanNamedCorsConfigurationSource": true
|
|
}
|
|
|
|
$ curl -s -i -X OPTIONS http://localhost:8080/api/data \
|
|
-H 'Origin: https://spa.example.com' \
|
|
-H 'Access-Control-Request-Method: POST' \
|
|
-H 'Access-Control-Request-Headers: content-type,x-xsrf-token'
|
|
|
|
HTTP/1.1 200
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
Access-Control-Allow-Origin: https://spa.example.com
|
|
Access-Control-Allow-Methods: GET,POST
|
|
Access-Control-Allow-Headers: content-type, x-xsrf-token
|
|
Access-Control-Allow-Credentials: true
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
# Compare with 02: there is no Access-Control-Max-Age here. CorsConfiguration
|
|
# leaves maxAge null, so every single cross-origin call re-runs the preflight.
|