public class CrossOriginFilter
extends java.lang.Object
implements javax.servlet.Filter
A typical example is to use this filter to allow cross-domain cometd communication using the standard long polling transport instead of the JSONP transport (that is less efficient and less reactive to failures).
This filter allows the following configuration parameters:
If an allowed origin contains one or more * characters (for example http://*.domain.com), then "*" characters are converted to ".*", "." characters are escaped to "\." and the resulting allowed origin interpreted as a regular expression.
Allowed origins can therefore be more complex expressions such as https?://*.domain.[a-z]{3} that matches http or https, multiple subdomains and any 3 letter top-level domain (.com, .net, .org, etc.).
The check whether the timing header is set, will be performed only if the user gets general access to the resource using the allowedOrigins.
<web-app ...> ... <filter> <filter-name>cross-origin</filter-name> <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class> </filter> <filter-mapping> <filter-name>cross-origin</filter-name> <url-pattern>/cometd/*</url-pattern> </filter-mapping> ... </web-app>
Modifier and Type | Field and Description |
---|---|
static java.lang.String |
ACCESS_CONTROL_ALLOW_CREDENTIALS_HEADER |
static java.lang.String |
ACCESS_CONTROL_ALLOW_HEADERS_HEADER |
static java.lang.String |
ACCESS_CONTROL_ALLOW_METHODS_HEADER |
static java.lang.String |
ACCESS_CONTROL_ALLOW_ORIGIN_HEADER |
static java.lang.String |
ACCESS_CONTROL_EXPOSE_HEADERS_HEADER |
static java.lang.String |
ACCESS_CONTROL_MAX_AGE_HEADER |
static java.lang.String |
ACCESS_CONTROL_REQUEST_HEADERS_HEADER |
static java.lang.String |
ACCESS_CONTROL_REQUEST_METHOD_HEADER |
static java.lang.String |
ALLOW_CREDENTIALS_PARAM |
private boolean |
allowCredentials |
static java.lang.String |
ALLOWED_HEADERS_PARAM |
static java.lang.String |
ALLOWED_METHODS_PARAM |
static java.lang.String |
ALLOWED_ORIGINS_PARAM |
static java.lang.String |
ALLOWED_TIMING_ORIGINS_PARAM |
private java.util.List<java.lang.String> |
allowedHeaders |
private java.util.List<java.lang.String> |
allowedMethods |
private java.util.List<java.lang.String> |
allowedOrigins |
private java.util.List<java.lang.String> |
allowedTimingOrigins |
private static java.lang.String |
ANY_ORIGIN |
private boolean |
anyHeadersAllowed |
private boolean |
anyOriginAllowed |
private boolean |
anyTimingOriginAllowed |
static java.lang.String |
CHAIN_PREFLIGHT_PARAM |
private boolean |
chainPreflight |
private static java.util.List<java.lang.String> |
DEFAULT_ALLOWED_HEADERS |
private static java.util.List<java.lang.String> |
DEFAULT_ALLOWED_METHODS |
private static java.lang.String |
DEFAULT_ALLOWED_ORIGINS |
private static java.lang.String |
DEFAULT_ALLOWED_TIMING_ORIGINS |
static java.lang.String |
EXPOSED_HEADERS_PARAM |
private java.util.List<java.lang.String> |
exposedHeaders |
private static Logger |
LOG |
static java.lang.String |
OLD_CHAIN_PREFLIGHT_PARAM |
private static java.lang.String |
ORIGIN_HEADER |
static java.lang.String |
PREFLIGHT_MAX_AGE_PARAM |
private int |
preflightMaxAge |
private static java.util.List<java.lang.String> |
SIMPLE_HTTP_METHODS |
static java.lang.String |
TIMING_ALLOW_ORIGIN_HEADER |
Constructor and Description |
---|
CrossOriginFilter() |
Modifier and Type | Method and Description |
---|---|
private boolean |
areHeadersAllowed(java.util.List<java.lang.String> requestedHeaders) |
private java.lang.String |
commify(java.util.List<java.lang.String> strings) |
private java.util.regex.Matcher |
createMatcher(java.lang.String origin,
java.lang.String allowedOrigin) |
void |
destroy() |
void |
doFilter(javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response,
javax.servlet.FilterChain chain) |
private boolean |
generateAllowedOrigins(java.util.List<java.lang.String> allowedOriginStore,
java.lang.String allowedOriginsConfig,
java.lang.String defaultOrigin) |
private java.util.List<java.lang.String> |
getAccessControlRequestHeaders(javax.servlet.http.HttpServletRequest request) |
private void |
handle(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
javax.servlet.FilterChain chain) |
private void |
handlePreflightResponse(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
java.lang.String origin) |
private void |
handleSimpleResponse(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
java.lang.String origin) |
void |
init(javax.servlet.FilterConfig config) |
protected boolean |
isEnabled(javax.servlet.http.HttpServletRequest request) |
private boolean |
isMethodAllowed(javax.servlet.http.HttpServletRequest request) |
private boolean |
isPreflightRequest(javax.servlet.http.HttpServletRequest request) |
private boolean |
isSimpleRequest(javax.servlet.http.HttpServletRequest request) |
private boolean |
originMatches(java.util.List<java.lang.String> allowedOrigins,
java.lang.String originList) |
private java.lang.String |
parseAllowedWildcardOriginToRegex(java.lang.String allowedOrigin) |
private static final Logger LOG
private static final java.lang.String ORIGIN_HEADER
public static final java.lang.String ACCESS_CONTROL_REQUEST_METHOD_HEADER
public static final java.lang.String ACCESS_CONTROL_REQUEST_HEADERS_HEADER
public static final java.lang.String ACCESS_CONTROL_ALLOW_ORIGIN_HEADER
public static final java.lang.String ACCESS_CONTROL_ALLOW_METHODS_HEADER
public static final java.lang.String ACCESS_CONTROL_ALLOW_HEADERS_HEADER
public static final java.lang.String ACCESS_CONTROL_MAX_AGE_HEADER
public static final java.lang.String ACCESS_CONTROL_ALLOW_CREDENTIALS_HEADER
public static final java.lang.String ACCESS_CONTROL_EXPOSE_HEADERS_HEADER
public static final java.lang.String TIMING_ALLOW_ORIGIN_HEADER
public static final java.lang.String ALLOWED_ORIGINS_PARAM
public static final java.lang.String ALLOWED_TIMING_ORIGINS_PARAM
public static final java.lang.String ALLOWED_METHODS_PARAM
public static final java.lang.String ALLOWED_HEADERS_PARAM
public static final java.lang.String PREFLIGHT_MAX_AGE_PARAM
public static final java.lang.String ALLOW_CREDENTIALS_PARAM
public static final java.lang.String EXPOSED_HEADERS_PARAM
public static final java.lang.String OLD_CHAIN_PREFLIGHT_PARAM
public static final java.lang.String CHAIN_PREFLIGHT_PARAM
private static final java.lang.String ANY_ORIGIN
private static final java.lang.String DEFAULT_ALLOWED_ORIGINS
private static final java.lang.String DEFAULT_ALLOWED_TIMING_ORIGINS
private static final java.util.List<java.lang.String> SIMPLE_HTTP_METHODS
private static final java.util.List<java.lang.String> DEFAULT_ALLOWED_METHODS
private static final java.util.List<java.lang.String> DEFAULT_ALLOWED_HEADERS
private boolean anyOriginAllowed
private boolean anyTimingOriginAllowed
private boolean anyHeadersAllowed
private java.util.List<java.lang.String> allowedOrigins
private java.util.List<java.lang.String> allowedTimingOrigins
private java.util.List<java.lang.String> allowedMethods
private java.util.List<java.lang.String> allowedHeaders
private java.util.List<java.lang.String> exposedHeaders
private int preflightMaxAge
private boolean allowCredentials
private boolean chainPreflight
public void init(javax.servlet.FilterConfig config) throws javax.servlet.ServletException
init
in interface javax.servlet.Filter
javax.servlet.ServletException
private boolean generateAllowedOrigins(java.util.List<java.lang.String> allowedOriginStore, java.lang.String allowedOriginsConfig, java.lang.String defaultOrigin)
public void doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain) throws java.io.IOException, javax.servlet.ServletException
doFilter
in interface javax.servlet.Filter
java.io.IOException
javax.servlet.ServletException
private void handle(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, javax.servlet.FilterChain chain) throws java.io.IOException, javax.servlet.ServletException
java.io.IOException
javax.servlet.ServletException
protected boolean isEnabled(javax.servlet.http.HttpServletRequest request)
private boolean originMatches(java.util.List<java.lang.String> allowedOrigins, java.lang.String originList)
private java.util.regex.Matcher createMatcher(java.lang.String origin, java.lang.String allowedOrigin)
private java.lang.String parseAllowedWildcardOriginToRegex(java.lang.String allowedOrigin)
private boolean isSimpleRequest(javax.servlet.http.HttpServletRequest request)
private boolean isPreflightRequest(javax.servlet.http.HttpServletRequest request)
private void handleSimpleResponse(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, java.lang.String origin)
private void handlePreflightResponse(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, java.lang.String origin)
private boolean isMethodAllowed(javax.servlet.http.HttpServletRequest request)
private java.util.List<java.lang.String> getAccessControlRequestHeaders(javax.servlet.http.HttpServletRequest request)
private boolean areHeadersAllowed(java.util.List<java.lang.String> requestedHeaders)
private java.lang.String commify(java.util.List<java.lang.String> strings)
public void destroy()
destroy
in interface javax.servlet.Filter