1
1
/*
2
- * Copyright 2002-2018 the original author or authors.
2
+ * Copyright 2002-2019 the original author or authors.
3
3
*
4
4
* Licensed under the Apache License, Version 2.0 (the "License");
5
5
* you may not use this file except in compliance with the License.
16
16
17
17
package org .springframework .web .cors ;
18
18
19
+ import java .time .Duration ;
19
20
import java .util .ArrayList ;
20
21
import java .util .Arrays ;
21
22
import java .util .Collections ;
@@ -52,14 +53,14 @@ public class CorsConfiguration {
52
53
/** Wildcard representing <em>all</em> origins, methods, or headers. */
53
54
public static final String ALL = "*" ;
54
55
55
- private static final List <HttpMethod > DEFAULT_METHODS =
56
- Collections . unmodifiableList ( Arrays .asList (HttpMethod .GET , HttpMethod .HEAD ));
56
+ private static final List <HttpMethod > DEFAULT_METHODS = Collections . unmodifiableList (
57
+ Arrays .asList (HttpMethod .GET , HttpMethod .HEAD ));
57
58
58
- private static final List <String > DEFAULT_PERMIT_ALL =
59
- Collections . unmodifiableList ( Arrays .asList (ALL ));
59
+ private static final List <String > DEFAULT_PERMIT_METHODS = Collections . unmodifiableList (
60
+ Arrays .asList (HttpMethod . GET . name (), HttpMethod . HEAD . name (), HttpMethod . POST . name () ));
60
61
61
- private static final List <String > DEFAULT_PERMIT_METHODS =
62
- Collections .unmodifiableList ( Arrays . asList ( HttpMethod . GET . name (), HttpMethod . HEAD . name (), HttpMethod . POST . name () ));
62
+ private static final List <String > DEFAULT_PERMIT_ALL = Collections . unmodifiableList (
63
+ Collections .singletonList ( ALL ));
63
64
64
65
65
66
@ Nullable
@@ -304,6 +305,16 @@ public Boolean getAllowCredentials() {
304
305
return this .allowCredentials ;
305
306
}
306
307
308
+ /**
309
+ * Configure how long, as a duration, the response from a pre-flight request
310
+ * can be cached by clients.
311
+ * @since 5.2
312
+ * @see #setMaxAge(Long)
313
+ */
314
+ public void setMaxAge (Duration maxAge ) {
315
+ this .maxAge = maxAge .getSeconds ();
316
+ }
317
+
307
318
/**
308
319
* Configure how long, in seconds, the response from a pre-flight request
309
320
* can be cached by clients.
@@ -322,22 +333,21 @@ public Long getMaxAge() {
322
333
return this .maxAge ;
323
334
}
324
335
336
+
325
337
/**
326
338
* By default a newly created {@code CorsConfiguration} does not permit any
327
339
* cross-origin requests and must be configured explicitly to indicate what
328
340
* should be allowed.
329
- *
330
341
* <p>Use this method to flip the initialization model to start with open
331
342
* defaults that permit all cross-origin requests for GET, HEAD, and POST
332
343
* requests. Note however that this method will not override any existing
333
344
* values already set.
334
- *
335
345
* <p>The following defaults are applied if not already set:
336
346
* <ul>
337
- * <li>Allow all origins.</li>
338
- * <li>Allow "simple" methods {@code GET}, {@code HEAD} and {@code POST}.</li>
339
- * <li>Allow all headers.</li>
340
- * <li>Set max age to 1800 seconds (30 minutes).</li>
347
+ * <li>Allow all origins.</li>
348
+ * <li>Allow "simple" methods {@code GET}, {@code HEAD} and {@code POST}.</li>
349
+ * <li>Allow all headers.</li>
350
+ * <li>Set max age to 1800 seconds (30 minutes).</li>
341
351
* </ul>
342
352
*/
343
353
public CorsConfiguration applyPermitDefaultValues () {
@@ -361,23 +371,19 @@ public CorsConfiguration applyPermitDefaultValues() {
361
371
/**
362
372
* Combine the non-null properties of the supplied
363
373
* {@code CorsConfiguration} with this one.
364
- *
365
374
* <p>When combining single values like {@code allowCredentials} or
366
375
* {@code maxAge}, {@code this} properties are overridden by non-null
367
376
* {@code other} properties if any.
368
- *
369
377
* <p>Combining lists like {@code allowedOrigins}, {@code allowedMethods},
370
378
* {@code allowedHeaders} or {@code exposedHeaders} is done in an additive
371
379
* way. For example, combining {@code ["GET", "POST"]} with
372
380
* {@code ["PATCH"]} results in {@code ["GET", "POST", "PATCH"]}, but keep
373
381
* in mind that combining {@code ["GET", "POST"]} with {@code ["*"]}
374
382
* results in {@code ["*"]}.
375
- *
376
383
* <p>Notice that default permit values set by
377
384
* {@link CorsConfiguration#applyPermitDefaultValues()} are overridden by
378
385
* any value explicitly defined.
379
- *
380
- * @return the combined {@code CorsConfiguration} or {@code this}
386
+ * @return the combined {@code CorsConfiguration}, or {@code this}
381
387
* configuration if the supplied configuration is {@code null}
382
388
*/
383
389
@ Nullable
0 commit comments