1
1
package com .blade .security .web .cors ;
2
2
3
3
import com .blade .mvc .RouteContext ;
4
- import com .blade .mvc .hook .WebHook ;
4
+ import com .blade .mvc .handler .RouteHandler ;
5
+ import com .blade .mvc .http .Response ;
6
+ import lombok .extern .slf4j .Slf4j ;
7
+
5
8
import java .util .StringJoiner ;
6
9
import java .util .stream .Collector ;
7
- import lombok .extern .slf4j .Slf4j ;
8
10
9
11
/**
10
12
* CorsMiddleware
13
+ * <p>
14
+ * This is a simple CORS policy,
15
+ * you can also implement the {@link CorsMiddleware#handle} method of the class to perform custom filtering.
11
16
*
12
17
* @author biezhi
13
18
* @date 2018/7/11
14
19
*/
15
20
@ Slf4j
16
- public class CorsMiddleware implements WebHook {
21
+ public class CorsMiddleware implements RouteHandler {
17
22
18
23
private CorsConfiger corsConfig ;
19
24
@@ -25,79 +30,76 @@ public CorsMiddleware(CorsConfiger corsConfiger) {
25
30
}
26
31
27
32
@ Override
28
- public boolean before (RouteContext context ) {
29
- this .allowCredentials (context )
30
- .allowMethods (context )
31
- .allowHeads (context )
32
- .setMaxAge (context )
33
- .allowCredentials (context );
34
- if ("OPTIONS" .equals (context .method ())) {
35
- context .status (202 );
36
- }
37
- return true ;
33
+ public void handle (RouteContext context ) {
34
+ context .header ("Access-Control-Allow-Methods" , "GET, POST, PUT, DELETE" );
35
+ context .header ("Access-Control-Allow-Origin" , "*" );
36
+ context .header ("Access-Control-Allow-Headers" , CorsConfiger .ALL );
37
+ context .status (204 );
38
38
}
39
39
40
- private CorsMiddleware allowHeads (RouteContext context ) {
40
+ private CorsMiddleware allowHeads (Response response ) {
41
41
boolean isDefaultAllowHeads = corsConfig == null || corsConfig .getAllowedHeaders () == null
42
- || corsConfig .getAllowedHeaders ().size () == 0 ;
42
+ || corsConfig .getAllowedHeaders ().size () == 0 ;
43
43
44
44
if (isDefaultAllowHeads ) {
45
- context . response () .header ("Access-Control-Allow-Headers" , CorsConfiger .ALL );
45
+ response .header ("Access-Control-Allow-Headers" , CorsConfiger .ALL );
46
46
return this ;
47
47
}
48
48
49
- String heads = corsConfig .getAllowedHeaders ().stream ().collect (Collector .of (
50
- () -> new StringJoiner ("," ),
51
- (j , head ) -> j .add (head ),
52
- StringJoiner ::merge ,
53
- StringJoiner ::toString
54
- ));
55
- context .response ().header ("Access-Control-Allow-Headers" , heads );
49
+ String heads = corsConfig .getAllowedHeaders ().stream ()
50
+ .collect (Collector .of (
51
+ () -> new StringJoiner ("," ),
52
+ StringJoiner ::add ,
53
+ StringJoiner ::merge ,
54
+ StringJoiner ::toString
55
+ ));
56
+
57
+ response .header ("Access-Control-Allow-Headers" , heads );
56
58
return this ;
57
59
}
58
60
59
- private CorsMiddleware allowMethods (RouteContext context ) {
61
+ private CorsMiddleware allowMethods (Response response ) {
60
62
boolean isDefaultAllowMethods = corsConfig == null || corsConfig .getAllowedMethods () == null
61
- || corsConfig .getAllowedMethods ().size () == 0 ;
63
+ || corsConfig .getAllowedMethods ().size () == 0 ;
62
64
63
65
if (isDefaultAllowMethods ) {
64
- context .header ("Access-Control-Allow-Methods" ,
65
- CorsConfiger .DEFAULT_ALLOWED_METHODS );
66
+ response .header ("Access-Control-Allow-Methods" ,
67
+ CorsConfiger .DEFAULT_ALLOWED_METHODS );
66
68
return this ;
67
69
}
68
70
69
71
String methods = corsConfig .getAllowedMethods ().stream ().collect (Collector .of (
70
- () -> new StringJoiner (", " ),
71
- (j , method ) -> j .add (method .toUpperCase ()),
72
- StringJoiner ::merge ,
73
- StringJoiner ::toString
72
+ () -> new StringJoiner (", " ),
73
+ (j , method ) -> j .add (method .toUpperCase ()),
74
+ StringJoiner ::merge ,
75
+ StringJoiner ::toString
74
76
));
75
77
76
- context . response () .header ("Access-Control-Allow-Methods" , methods );
78
+ response .header ("Access-Control-Allow-Methods" , methods );
77
79
return this ;
78
80
}
79
81
80
- private CorsMiddleware allowCredentials (RouteContext context ) {
82
+ private CorsMiddleware allowCredentials (Response response ) {
81
83
boolean isDefaultAllowCredentials = corsConfig == null || corsConfig .getAllowCredentials () == null ;
82
84
83
85
if (isDefaultAllowCredentials ) {
84
- context .header ("Access-Control-Allow-Credentials" ,
85
- CorsConfiger .DEFAULT_ALLOW_CREDENTIALS );
86
+ response .header ("Access-Control-Allow-Credentials" ,
87
+ CorsConfiger .DEFAULT_ALLOW_CREDENTIALS );
86
88
return this ;
87
89
}
88
- context . response () .header ("Access-Control-Allow-Credentials" ,
89
- corsConfig .getAllowCredentials ().toString ());
90
+ response .header ("Access-Control-Allow-Credentials" ,
91
+ corsConfig .getAllowCredentials ().toString ());
90
92
return this ;
91
93
}
92
94
93
- private CorsMiddleware setMaxAge (RouteContext context ) {
95
+ private CorsMiddleware setMaxAge (Response response ) {
94
96
boolean isDefaultMaxAge = corsConfig == null || corsConfig .getMaxAge () == null ;
95
97
if (isDefaultMaxAge ) {
96
- context . response () .header ("Access-Control-Max-Age" ,
97
- CorsConfiger .DEFAULT_MAX_AGE .toString ());
98
+ response .header ("Access-Control-Max-Age" ,
99
+ CorsConfiger .DEFAULT_MAX_AGE .toString ());
98
100
return this ;
99
101
}
100
- context .header ("Access-Control-Max-Age" , corsConfig .getMaxAge ().toString ());
102
+ response .header ("Access-Control-Max-Age" , corsConfig .getMaxAge ().toString ());
101
103
return this ;
102
104
}
103
105
0 commit comments