https://github.com/santoszv/cors-filter
Cross-Origin Resource Sharing (CORS) Web Filter
https://github.com/santoszv/cors-filter
cors kotlin web
Last synced: 5 months ago
JSON representation
Cross-Origin Resource Sharing (CORS) Web Filter
- Host: GitHub
- URL: https://github.com/santoszv/cors-filter
- Owner: santoszv
- License: apache-2.0
- Created: 2019-03-03T16:04:53.000Z (over 7 years ago)
- Default Branch: master
- Last Pushed: 2019-09-05T04:05:08.000Z (almost 7 years ago)
- Last Synced: 2023-07-05T04:15:06.218Z (almost 3 years ago)
- Topics: cors, kotlin, web
- Language: Kotlin
- Homepage:
- Size: 86.9 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Cross-Origin Resource Sharing (CORS) Web Filter
User agents commonly apply same-origin restrictions to network requests. These
restrictions prevent a client-side Web application running from one origin from
obtaining data retrieved from another origin, and also limit unsafe HTTP
requests that can be automatically launched toward destinations that differ
from the running application's origin.
In user agents that follow this pattern, network requests typically include
user credentials with cross-origin requests, including HTTP authentication and
cookie information.
This specification extends this model in several ways:
- A response can include an Access-Control-Allow-Origin header, with the origin
of where the request originated from as the value, to allow access to the
resource's contents.
The user agent validates that the value and origin of where the request
originated match.
- User agents can discover via a preflight request whether a cross-origin
resource is prepared to accept requests, using a non-simple method, from a
given origin.
This is again validated by the user agent.
- Server-side applications are enabled to discover that an HTTP request was
deemed a cross-origin request by the user agent, through the Origin header.
This extension enables server-side applications to enforce limitations (e.g.
returning nothing) on the cross-origin requests that they are willing to
service.
## Usage in Gradle (Kotlin)
1. Add Maven Central repository
```
repositories {
mavenCentral()
}
```
2. Add dependencies
```
dependencies {
implementation("mx.com.inftel.oss:cors-filter:1.2.0")
}
```
3. Create a CORS policies file in classpath
Full CORS policies file:
```
http://frontend.domain.com
https://frontend.domain.com
http://frontend.domain.com:8080
https://frontend.domain.com:8443
HEAD
GET
POST
PUT
DELETE
Authorization
Content-Type
X-Anti-CSRF
X-Requested-With
Content-Length
WWW-Authenticate
Server-Authenticate
X-Anti-CSRF
false
-1
false
false
```
Recommended minimal CORS policies file:
```
Authorization
Content-Type
Content-Length
WWW-Authenticate
Server-Authenticate
```
4. Add filter to web.xml
Example of filter using CORS policies file named cors-policies.xml at root
package:
```
CORS
mx.com.inftel.cors.CORSServletFilter
cors-policies
cors-policies.xml
```
5. Map filter to desired locations
```
CORS
/api/*
REQUEST
```
## License
Copyright 2019 Santos Zatarain Vera
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
## Notice
Copyright 2019 Santos Zatarain Vera (coder.santoszv_at_gmail.com). This
product includes coded software by Santos Zatarain Vera and licensed under the
Apache License, Version 2.0 (https://github.com/santoszv/cors-filter).
Copyright (C) 2015 W3C (R) (MIT, ERCIM, Keio, Beihang). This software or
document includes material copied from or derived from Cross-Origin
Resource Sharing W3C Recommendation (https://www.w3.org/TR/cors/).