59 lines
1.9 KiB
Plaintext
59 lines
1.9 KiB
Plaintext
==============================================================================
|
|
docs/output/01-mvc-only.txt
|
|
CORS configured with WebMvcConfigurer.addCorsMappings and nothing else.
|
|
Profile: mvconly
|
|
==============================================================================
|
|
|
|
# The security chain. Note what is NOT in it.
|
|
$ curl -s localhost:8080/diag/chain
|
|
{
|
|
"profiles": [
|
|
"mvconly"
|
|
],
|
|
"chains": [
|
|
{
|
|
"size": 11,
|
|
"filters": [
|
|
"DisableEncodeUrlFilter",
|
|
"WebAsyncManagerIntegrationFilter",
|
|
"SecurityContextHolderFilter",
|
|
"HeaderWriterFilter",
|
|
"LogoutFilter",
|
|
"BasicAuthenticationFilter",
|
|
"RequestCacheAwareFilter",
|
|
"SecurityContextHolderAwareRequestFilter",
|
|
"AnonymousAuthenticationFilter",
|
|
"ExceptionTranslationFilter",
|
|
"AuthorizationFilter"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
|
|
# CorsConfigurationSource beans in the context.
|
|
$ curl -s localhost:8080/diag/cors-sources
|
|
{
|
|
"corsConfigurationSourceBeans": {
|
|
"mvcHandlerMappingIntrospector": "HandlerMappingIntrospector"
|
|
},
|
|
"hasBeanNamedCorsConfigurationSource": false
|
|
}
|
|
|
|
$ curl -s -i -X OPTIONS http://localhost:8080/api/data \
|
|
-H 'Origin: https://spa.example.com' \
|
|
-H 'Access-Control-Request-Method: POST' \
|
|
-H 'Access-Control-Request-Headers: content-type,x-xsrf-token'
|
|
|
|
HTTP/1.1 401
|
|
Set-Cookie: JSESSIONID=<session>; Path=/; HttpOnly; SameSite=Lax
|
|
WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
# The MVC CORS mapping is real - it just never runs, because the request is
|
|
# rejected at AuthorizationFilter (order 4200) and the DispatcherServlet is
|
|
# downstream of the entire filter chain.
|