40 lines
1.8 KiB
Plaintext
40 lines
1.8 KiB
Plaintext
==============================================================================
|
|
docs/output/05-misnamed-bean.txt
|
|
The same UrlBasedCorsConfigurationSource bean, named apiCorsSource instead of
|
|
corsConfigurationSource. It starts. The preflight returns 200. It carries no CORS headers.
|
|
Profile: misnamed
|
|
==============================================================================
|
|
|
|
$ curl -s localhost:8080/diag/cors-sources
|
|
{
|
|
"corsConfigurationSourceBeans": {
|
|
"apiCorsSource": "UrlBasedCorsConfigurationSource",
|
|
"mvcHandlerMappingIntrospector": "HandlerMappingIntrospector"
|
|
},
|
|
"hasBeanNamedCorsConfigurationSource": false
|
|
}
|
|
|
|
$ curl -s -i -X OPTIONS http://localhost:8080/api/data \
|
|
-H 'Origin: https://spa.example.com' \
|
|
-H 'Access-Control-Request-Method: POST' \
|
|
-H 'Access-Control-Request-Headers: content-type,x-xsrf-token'
|
|
|
|
HTTP/1.1 200
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
<timestamp> DEBUG <pid> --- [cors-csrf-samesite] [nio-8080-exec-N] o.s.web.cors.DefaultCorsProcessor : Skip: no CORS configuration has been provided
|
|
|
|
# Two different lookups. HttpSecurityConfiguration.applyCorsIfAvailable asks
|
|
# getBeanNamesForType(UrlBasedCorsConfigurationSource.class) and enables CORS if the
|
|
# array is non-empty, so the bean above DID switch the configurer on.
|
|
# CorsConfigurer.getCorsConfigurationSource then asks
|
|
# containsBeanDefinition("corsConfigurationSource"), which is false, and falls back
|
|
# to Spring MVC's registrations - of which there are none.
|
|
# CorsFilter returns from every preflight whether or not it found a configuration:
|
|
# if (!isValid || CorsUtils.isPreFlightRequest(request)) { return; }
|
|
# so the OPTIONS never reaches AuthorizationFilter and the client gets a bare 200.
|