add multiple cross origin urls in spring boot

Question

I found an example on how to set cors headers in spring-boot application. Since we have many origins, I need to add them. Is the following valid?

@Configuration
@EnableWebMvc
public class WebConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
            .allowedOrigins("http://domain1.com")
            .allowedOrigins("http://domain2.com")
            .allowedOrigins("http://domain3.com")
    }
}

I have no way to test this unless it is used by three domains. But I want to make sure I have three origins set up and not only "domain3.com" is set.

EDIT: ideal use case for is to inject a list of domains(from application.properties) and set that in allowedOrigins. Is it possible

i.e

  @Value("${domainsList: not configured}")
    private List<String> domains;

@Configuration
@EnableWebMvc
public class WebConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
            .allowedOrigins(domains)
    }
}

Can someone look into https://stackoverflow.com/q/59300723/8874958 ? — Kishan Solanki, Dec 12 '19 at 08:58
See this post answer by miko about Spring supporting wildcards by setAllowedOriginPatterns: https://stackoverflow.com/questions/27147737/cors-filter-allow-all-sub-domains — user2025527, Jan 19 '21 at 11:20

score 59 · Answer 1 · edited Mar 20 '23 at 21:30

59

In Spring boot there is an annotation @CrossOrigin which will simply add header in the response.

For multiple:

@CrossOrigin(origins = {"http://localhost:7777", "http://someserver:8080"})
@RequestMapping(value = "/abc", method = RequestMethod.GET)
@ResponseBody
public Object doSomething(){
  ...
}

If you wanna allow for everyone then simply use.

@CrossOrigin

edited Mar 20 '23 at 21:30

Toni

3,296
2
13
34

answered Sep 28 '17 at 21:59

Sumit Sundriyal

815
1
11
14

score 34 · Accepted Answer · edited Oct 15 '19 at 15:02

34

The way you are setting will only set the third origin and the other two will be gone.

if you want all the three origins to be set then you need to pass them as comma separated Strings.

@Override
public void addCorsMappings(CorsRegistry registry) {
    registry.addMapping("/api/**")
        .allowedOrigins("http://domain1.com","http://domain2.com"
                        "http://domain3.com");
}

you can find the actual code here:

https://github.com/spring-projects/spring-framework/blob/00d2606b000f9bdafbd7f4a16b6599fb51b53fa4/spring-webmvc/src/main/java/org/springframework/web/servlet/config/annotation/CorsRegistration.java#L61

https://github.com/spring-projects/spring-framework/blob/31aed61d1543f9f24a82a204309c0afb71dd3912/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java#L122

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.PropertySource;
import org.springframework.core.env.Environment;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

@Configuration
@EnableWebMvc
@PropertySource("classpath:config.properties")
public class CorsClass extends WebMvcConfigurerAdapter {

    @Autowired
    private Environment environment;

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        String origins = environment.getProperty("origins");
        registry.addMapping("/api/**")
                .allowedOrigins(origins.split(","));
    }
}

edited Oct 15 '19 at 15:02

Ahmad Sajadian

29
3

answered Sep 21 '16 at 17:50

Deendayal Garg

5,030
2
19
33

can these domains be read from properties file? I.e I inject the values and pass them to `.allowedOrigins` ? – brain storm Sep 21 '16 at 19:14
or is there a way to pass list? – brain storm Sep 21 '16 at 19:15
sure. Can be done. Updated answer. there could be other ways too. thats one way. Assuming you have a `config.properties` file in your classpath and the file has a key name origin with values separated by `Comma` – Deendayal Garg Sep 21 '16 at 19:19
passing list isn't possible as `allowedOrigins` takes array as input. – Deendayal Garg Sep 21 '16 at 19:22
can I simply pass array instead of list then? – brain storm Sep 21 '16 at 19:23
btw. is `foo.com` and `www.foo.com` considered different origins? – brain storm Sep 21 '16 at 19:24
I Think both are different, you need to register both. The internal implementation just gets the origin from header and check for strings equality. – Deendayal Garg Sep 21 '16 at 19:43
This will not work if you are using '@CrossOrigin' annotation. How do you pass multiple domains set in application.properties file to '@CrossOrigin' annotation you would use on array controller class? – pixel Mar 20 '23 at 20:54

score 4 · Answer 3 · answered Sep 21 '16 at 17:49

4

This would not work, try instead :

registry.addMapping("/api/**")
        .allowedOrigins(
           "http://domain1.com",
           "http://domain2.com",
           "http://domain3.com")

see also spring reference cors

answered Sep 21 '16 at 17:49

Stefan Isele - prefabware.com

8,905
4
28
31

how can I pass a list of domains instead of hardcoding here? – brain storm Sep 21 '16 at 19:16
@brainstorm Just declare an array of strings (String[] originArray = new Array[] {"http://domain1.com", "http://domain2.com", "http://domain3.com"}) and pass it to .allowedOrigins-Method (...allowedOrigins(originArray) ). – Sercan Samet Savran Sep 07 '20 at 05:32

score 3 · Answer 4 · answered Sep 18 '18 at 17:23

If you're using a Global CORS with Springboot and want to add multiple domains, this is how I've done it:

In your property file, you can add your property and domains as below:

allowed.origins=*.someurl.com,*.otherurl.com,*.someotherurl.com

And your your Config Class:

@EnableWebMvc
@Configuration
public class AppConfig extends WebMvcConfigurerAdapter {

private static final Logger logger = LoggerFactory.getLogger(AppConfig.class);

@Value("#{'${allowed.origins}'.split(',')}")
private List<String> rawOrigins;

@Bean
public RestTemplate restTemplate() {
    return new RestTemplate();
}

@Bean
public WebMvcConfigurer corsConfigurer() {
    return new WebMvcConfigurerAdapter() {
        @Override
        public void addCorsMappings(CorsRegistry registry) {
            logger.info("Adding CORS to the service");
            registry.addMapping("/**")
                        .allowedOrigins(getOrigin())
                    .allowedMethods(HttpMethod.GET.name(), HttpMethod.POST.name(), HttpMethod.OPTIONS.name())
                    .allowedHeaders(HttpHeaders.AUTHORIZATION, HttpHeaders.CONTENT_TYPE, "accessToken", "CorrelationId", "source")
                    .exposedHeaders(HttpHeaders.AUTHORIZATION, HttpHeaders.CONTENT_TYPE, "accessToken", "CorrelationId", "source")
                    .maxAge(4800);
        }
         /**
         * This is to add Swagger to work when CORS is enabled
         */
        @Override
        public void addResourceHandlers(ResourceHandlerRegistry registry) {

               registry.addResourceHandler("swagger-ui.html")
                        .addResourceLocations("classpath:/META-INF/resources/");

                registry.addResourceHandler("/webjars/**")
                        .addResourceLocations("classpath:/META-INF/resources/webjars/");

        }
    };
}


public String[] getOrigin() {
    int size = rawOrigins.size();
    String[] originArray = new String[size];
    return rawOrigins.toArray(originArray);
}
}

Hope, this helps you and others who are looking for Spring enabled CORS.

I don't believe this will work using a wildcard at the subdomain level -- in other words, your `allowed.origins` list should be exact domains. — Hugh, Jan 20 '20 at 16:55
@Hugh, How to make it work with a wildcard at the subdomain? — dileepkumar jami, Feb 06 '23 at 18:18
While this works in-code like this, how would you set in inside of `@CrossOrigin` annotation? — pixel, Mar 20 '23 at 20:43

score 2 · Answer 5 · edited Apr 16 '21 at 17:04

resources/application.yaml

server:
  port: 8080
  servlet:
    contextPath: /your-service
  jetty:
    acceptors: 1
    maxHttpPostSize: 0
  cors:
    origins:
      - http://localhost:3001
      - https://app.mydomainnnn.com
      - https://app.yourrrrdooomain.com

config/Config.java

package com.service.config;

import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Configuration;

import java.util.ArrayList;
import java.util.List;

@Configuration
@EnableConfigurationProperties
@ConfigurationProperties("server")
public class Config {

  private int port;
  private Cors cors;

  public int getPort() {
    return this.port;
  }

  public void setPort(int port) {
    this.port = port;
  }

  public Cors getCors() {
    return this.cors;
  }

  public void setCors(Cors cors) {
    this.cors = cors;
  }

  public static class Cors {
    private List<String> origins = new ArrayList<>();

    public List<String> getOrigins() {
      return this.origins;
    }

    public void setOrigins(List<String> origins) {
      this.origins = origins;
    }
  }
}

config/WebConfig.java

package com.service.config;

import java.util.Arrays; 
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.PropertySource;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.core.env.Environment;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

@Configuration
@EnableWebMvc
@ComponentScan(basePackages = "com.service.controller")
@PropertySource("classpath:application.yaml")
public class WebConfig extends WebMvcConfigurerAdapter {

    @Autowired
    private Environment environment;

    @Autowired
    private Config config;

    @Override
    public void addCorsMappings(CorsRegistry registry) {
      System.out.println("configuring cors");
      String[] origins = config.getCors().getOrigins().toArray(String[]::new);
      System.out.println("  - origins " + Arrays.toString(origins));
      registry.addMapping("/**")
              .allowedOrigins(origins);
    }
}

score 1 · Answer 6 · answered Jul 16 '20 at 18:22

Create your custom annotation and annotate the API with that.

@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.METHOD})
@CrossOrigin
public @interface CrossOriginsList {

    public String[] crossOrigins() default  {

            "http://domain1.com", "http://domain1.com"
            "http://domain1.com", "http://domain1.com"
            // Pass as many as you want
    };
}

And now Annotate your API with this custom Annotation

@CrossOriginsList
    public String methodName() throws Exception
{
        //Business Logic
}

Worked perfectly fine for me.!!

score 0 · Answer 7 · answered Sep 07 '22 at 14:19

This works for me using Springboot 2.7.0

application.yml

allowedOrigins: http://localhost:[*], http://*.your-domain.com:[*]

CorsConfig

@Configuration
public class CorsConfig {


@Value("${allowedOrigins}")
private List<String> domains;

@Bean
public FilterRegistrationBean<CorsFilter> corsFilterRegistrationBean(){
          UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          CorsConfiguration config = new CorsConfiguration();
          
          // very important to allow patterns !!!
          config.setAllowedOriginPatterns(domains);

          source.registerCorsConfiguration("/**", config); 
          .....
          return new FilterRegistrationBean<>(new CorsFilter(source));
}

score 0 · Answer 8 · answered Feb 09 '23 at 05:26

with spring-security 6, it works for me.

 http.cors().configurationSource(new CorsConfigurationSource() {
        @Override
        public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {
            CorsConfiguration config = new CorsConfiguration();
            config.setAllowedOrigins(Collections.singletonList("http://localhost:4200"));
            config.setAllowedMethods(Collections.singletonList("*"));
            config.setAllowCredentials(true);
            config.setAllowedHeaders(Collections.singletonList("*"));
            config.setMaxAge(3600L);
            return config;
        }

add multiple cross origin urls in spring boot

8 Answers8

Linked