Package org.springframework.web.filter

# Class CorsFilter

java.lang.Object
org.springframework.web.filter.GenericFilterBean
org.springframework.web.filter.OncePerRequestFilter
org.springframework.web.filter.CorsFilter

All Implemented Interfaces:
  `Filter`, `org.springframework.beans.factory.Aware`, `org.springframework.beans.factory.BeanNameAware`, `org.springframework.beans.factory.DisposableBean`, `org.springframework.beans.factory.InitializingBean`, `org.springframework.context.EnvironmentAware`, `org.springframework.core.env.EnvironmentCapable`, `ServletContextAware`

public class CorsFilter extends OncePerRequestFilter
`Filter` to handle CORS pre-flight requests and intercept CORS simple and actual requests with a `CorsProcessor`, and to update the response, for example, with CORS response headers, based on the policy matched through the provided `CorsConfigurationSource`.

This is an alternative to configuring CORS in the Spring MVC Java config and the Spring MVC XML namespace. It is useful for applications depending only on spring-web (not on spring-webmvc) or for security constraints that require CORS checks to be performed at `Filter` level.

This filter could be used in conjunction with `DelegatingFilterProxy` in order to help with its initialization.

Since:
  4.2
Author:
  Sebastien Deleuze
See Also:
  - CORS W3C recommendation
  - `UrlBasedCorsConfigurationSource`

## Field Summary

### Fields inherited from class org.springframework.web.filter.OncePerRequestFilter

`ALREADY_FILTERED_SUFFIX`

### Fields inherited from class org.springframework.web.filter.GenericFilterBean

`logger`

## Constructor Summary

Constructors
Constructor
Description
`CorsFilter(CorsConfigurationSource configSource)`
Constructor accepting a `CorsConfigurationSource` used by the filter to find the `CorsConfiguration` to use for each incoming request.

## Method Summary

Modifier and Type
Method
Description
`protected void`
`doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)`
Same contract as for `doFilter`, but guaranteed to be just invoked once per request within a single request thread.
`void`
`setCorsProcessor(CorsProcessor processor)`
Configure a custom `CorsProcessor` to use to apply the matched `CorsConfiguration` for a request.

### Methods inherited from class org.springframework.web.filter.OncePerRequestFilter

`doFilter, doFilterNestedErrorDispatch, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted, shouldNotFilter, shouldNotFilterAsyncDispatch, shouldNotFilterErrorDispatch`

### Methods inherited from class org.springframework.web.filter.GenericFilterBean

`addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### CorsFilter

public CorsFilter(CorsConfigurationSource configSource)
Constructor accepting a `CorsConfigurationSource` used by the filter to find the `CorsConfiguration` to use for each incoming request.

See Also:
  - `UrlBasedCorsConfigurationSource`

## Method Details

### setCorsProcessor

public void setCorsProcessor(CorsProcessor processor)
Configure a custom `CorsProcessor` to use to apply the matched `CorsConfiguration` for a request.

By default `DefaultCorsProcessor` is used.

### doFilterInternal

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException
Description copied from class: `OncePerRequestFilter`
Same contract as for `doFilter`, but guaranteed to be just invoked once per request within a single request thread. See `OncePerRequestFilter.shouldNotFilterAsyncDispatch()` for details.

Provides HttpServletRequest and HttpServletResponse arguments instead of the default ServletRequest and ServletResponse ones.

Specified by:
  `doFilterInternal` in class `OncePerRequestFilter`
Throws:
  `ServletException`
  `IOException`