Skip to content

CORS: 'Access-Control-Request-Method' should only be returned on a Preflight Request #620

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 17, 2022
Merged

CORS: 'Access-Control-Request-Method' should only be returned on a Preflight Request #620

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c0a521d
Access-Control-Request-Method is only returned on a Preflight Request.
ggallotti Oct 7, 2022
a2223bb
Merge branch 'master' into cors-preflight
ggallotti Oct 7, 2022
165edd4
Merge branch 'master' into cors-preflight
claudiamurialdo Oct 14, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 23 additions & 20 deletions wrappercommon/src/main/java/com/genexus/cors/CORSHelper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,33 +12,25 @@ public class CORSHelper {

private static String CORS_ALLOWED_ORIGIN = "CORS_ALLOW_ORIGIN";
private static String CORS_MAX_AGE_SECONDS = "86400";

private static String PREFLIGHT_REQUEST = "OPTIONS";

public static boolean corsSupportEnabled() {
return getAllowedOrigin() != null;
}

public static HashMap<String, String> getCORSHeaders(Map<String, List<String>> headers) {
String corsAllowedOrigin = getAllowedOrigin();
if (corsAllowedOrigin == null) return null;
public static HashMap<String, String> getCORSHeaders(String httpMethod, Map<String, List<String>> headers) {
if (getAllowedOrigin() == null) {
return null;
}

String requestedMethod = getHeaderValue(REQUEST_METHOD_HEADER_NAME, headers);
String requestedHeaders = getHeaderValue(REQUEST_HEADERS_HEADER_NAME, headers);
if (requestedMethod == null) {
return null;
}

return corsHeaders(corsAllowedOrigin, requestedMethod, requestedHeaders);
return corsHeaders(httpMethod, requestedMethod, requestedHeaders);
}

public static HashMap<String, String> getCORSHeaders(String requestedMethod, String requestedHeaders) {
String corsAllowedOrigin = getAllowedOrigin();

if (corsAllowedOrigin == null || requestedMethod == null) {
return null;
}

return corsHeaders(corsAllowedOrigin, requestedMethod, requestedHeaders);
public static HashMap<String, String> getCORSHeaders(String httpMethod, String requestedMethod, String requestedHeaders) {
return corsHeaders(httpMethod, requestedMethod, requestedHeaders);
}

private static String getAllowedOrigin() {
Expand All @@ -49,15 +41,26 @@ private static String getAllowedOrigin() {
return corsAllowedOrigin;
}

private static HashMap<String, String> corsHeaders(String corsAllowedOrigin, String requestedMethod, String requestedHeaders) {
private static HashMap<String, String> corsHeaders(String httpMethodName, String requestedMethod, String requestedHeaders) {
String corsAllowedOrigin = getAllowedOrigin();
if (corsAllowedOrigin == null) {
return null;
}

boolean isPreflightRequest = httpMethodName.equalsIgnoreCase(PREFLIGHT_REQUEST);

HashMap<String, String> corsHeaders = new HashMap<>();
corsHeaders.put("Access-Control-Allow-Origin", corsAllowedOrigin);
corsHeaders.put("Access-Control-Allow-Credentials", "true");
if (requestedHeaders != null && !requestedHeaders.isEmpty()) {
corsHeaders.put("Access-Control-Max-Age", CORS_MAX_AGE_SECONDS);

if (isPreflightRequest && requestedHeaders != null && !requestedHeaders.isEmpty()) {
corsHeaders.put("Access-Control-Allow-Headers", requestedHeaders);
}
corsHeaders.put("Access-Control-Allow-Methods", requestedMethod);
corsHeaders.put("Access-Control-Max-Age", CORS_MAX_AGE_SECONDS);
if (isPreflightRequest && requestedMethod != null && !requestedMethod.isEmpty()) {
corsHeaders.put("Access-Control-Allow-Methods", requestedMethod);
}

return corsHeaders;
}

Expand Down
2 changes: 1 addition & 1 deletion wrapperjakarta/src/main/java/com/genexus/servlet/CorsFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ public void init(FilterConfig filterConfig) throws ServletException {
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) servletRequest;

HashMap<String, String> corsHeaders = CORSHelper.getCORSHeaders(request.getHeader(CORSHelper.REQUEST_METHOD_HEADER_NAME), request.getHeader(CORSHelper.REQUEST_HEADERS_HEADER_NAME));
HashMap<String, String> corsHeaders = CORSHelper.getCORSHeaders(request.getMethod(), request.getHeader(CORSHelper.REQUEST_METHOD_HEADER_NAME), request.getHeader(CORSHelper.REQUEST_HEADERS_HEADER_NAME));
if (corsHeaders != null) {
HttpServletResponse response = (HttpServletResponse) servletResponse;
for (String headerName : corsHeaders.keySet()) {
Expand Down
2 changes: 1 addition & 1 deletion wrapperjakarta/src/main/java/com/genexus/ws/JAXRSCorsFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ public class JAXRSCorsFilter implements ContainerResponseFilter {
@Override
public void filter(ContainerRequestContext requestContext,
ContainerResponseContext responseContext) {
HashMap<String, String> corsHeaders = CORSHelper.getCORSHeaders(requestContext.getHeaders());
HashMap<String, String> corsHeaders = CORSHelper.getCORSHeaders(requestContext.getMethod(), requestContext.getHeaders());
if (corsHeaders == null) {
return;
}
Expand Down
2 changes: 1 addition & 1 deletion wrapperjavax/src/main/java/com/genexus/servlet/CorsFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ public void init(FilterConfig filterConfig) throws ServletException {
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) servletRequest;
HashMap<String, String> corsHeaders = CORSHelper.getCORSHeaders(request.getHeader(CORSHelper.REQUEST_METHOD_HEADER_NAME), request.getHeader(CORSHelper.REQUEST_HEADERS_HEADER_NAME));
HashMap<String, String> corsHeaders = CORSHelper.getCORSHeaders(request.getMethod(), request.getHeader(CORSHelper.REQUEST_METHOD_HEADER_NAME), request.getHeader(CORSHelper.REQUEST_HEADERS_HEADER_NAME));
if (corsHeaders != null) {
HttpServletResponse response = (HttpServletResponse) servletResponse;
for (String headerName : corsHeaders.keySet()) {
Expand Down
2 changes: 1 addition & 1 deletion wrapperjavax/src/main/java/com/genexus/ws/JAXRSCorsFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ public class JAXRSCorsFilter implements ContainerResponseFilter {
@Override
public void filter(ContainerRequestContext requestContext,
ContainerResponseContext responseContext) {
HashMap<String, String> corsHeaders = CORSHelper.getCORSHeaders(requestContext.getHeaders());
HashMap<String, String> corsHeaders = CORSHelper.getCORSHeaders(requestContext.getMethod(), requestContext.getHeaders());
if (corsHeaders == null) {
return;
}
Expand Down