Annotation Type CrossOrigin

@Retention(CLASS) @Target({TYPE,METHOD}) public @interface CrossOrigin

A cross-origin policy for one controller or one handler, as Spring's @CrossOrigin is. On a class it covers every route of the controller; on a method it replaces the class's for that route.

The route's policy replaces the global cn1.cors.* policy for requests to that route -- the preflight, the reject of an origin it does not list and the response headers alike -- rather than being merged with it, so what a route allows is read off its annotation alone. A preflight for such a route is answered before the security chain, as the global policy's is, because a browser sends no credentials with one.

@CrossOrigin(origins = "https://app.example.com", allowCredentials = true)
@GetMapping("/api/me")
public Profile me(@AuthenticationPrincipal User user) { ... }

  • Optional Element Summary

    Optional Elements
    Modifier and Type
    Optional Element
    Description
    boolean
    allowCredentials
    Whether the browser may send cookies and read the response with them.
    String[]
    allowedHeaders
    The request headers a preflight may ask for; * allows any.
    String[]
    exposedHeaders
    Response headers a script may read beyond the safelisted ones.
    int
    maxAge
    How long, in seconds, a browser may cache the preflight answer.
    String[]
    methods
    The methods a preflight may ask for; empty allows the route's own.
    String[]
    origins
    The origins allowed, each scheme://host[:port], or * for any.
    String[]
    value
    The same as origins(), as Spring spells it on its value attribute.

  • Element Details

    • origins

      String[] origins
      The origins allowed, each scheme://host[:port], or * for any.
      Default:
      {"*"}

    • value

      String[] value
      The same as origins(), as Spring spells it on its value attribute.
      Default:
      {}

    • methods

      String[] methods
      The methods a preflight may ask for; empty allows the route's own.
      Default:
      {}

    • allowedHeaders

      String[] allowedHeaders
      The request headers a preflight may ask for; * allows any.
      Default:
      {"*"}

    • exposedHeaders

      String[] exposedHeaders
      Response headers a script may read beyond the safelisted ones.
      Default:
      {}

    • allowCredentials

      boolean allowCredentials
      Whether the browser may send cookies and read the response with them. Needs origins() to list the origins: a browser refuses * with credentials.
      Default:
      false

    • maxAge

      int maxAge
      How long, in seconds, a browser may cache the preflight answer.
      Default:
      1800