Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Refine CORS documentation for wildcard processing #31168

Closed
github-actions bot opened this issue Sep 4, 2023 · 0 comments
Closed

Refine CORS documentation for wildcard processing #31168

github-actions bot opened this issue Sep 4, 2023 · 0 comments
Assignees
@sdeleuze
Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: backport An issue that is a backport of another issue to a maintenance branch type: documentation A documentation task
Milestone
5.3.30

Comments

@github-actions
Copy link

github-actions bot commented Sep 4, 2023

Backport of gh-31143
@github-actions github-actions bot added in: web Issues in web modules (web, webmvc, webflux, websocket) type: backport An issue that is a backport of another issue to a maintenance branch type: bug A general bug labels Sep 4, 2023
@github-actions github-actions bot added this to the 5.3.30 milestone Sep 4, 2023
@sdeleuze sdeleuze self-assigned this Sep 4, 2023
@sdeleuze sdeleuze added type: documentation A documentation task and removed type: bug A general bug labels Sep 11, 2023
@sdeleuze sdeleuze changed the title CORS configuration - * wildcard with credentials is not overwritten Refine CORS documentation for wildcard processing Sep 11, 2023
sdeleuze added a commit to sdeleuze/spring-framework that referenced this issue Sep 11, 2023
@sdeleuze
Refine CORS documentation for wildcard processing
75faf69 
This commit refines CORS wildcard processing Javadoc to
provides more details on how wildcards are handled for
Access-Control-Allow-Methods, Access-Control-Allow-Headers
and Access-Control-Expose-Headers CORS headers.

For Access-Control-Expose-Headers, it is not possible to copy
the response headers which are not available at the point
when the CorsProcessor is invoked. Since all the major browsers
seem to support wildcard including on requests with credentials,
and since this is ultimately the user-agent responsibility to
check on client-side what is authorized or not, Spring Framework
continues to support this use case.

See spring-projectsgh-31168
sdeleuze added a commit to sdeleuze/spring-framework that referenced this issue Sep 11, 2023
@sdeleuze
Refine CORS documentation for wildcard processing
40678bb 
This commit adds a reference documentation section dedicated
to CORS credentialed requests and related wildcard processing.

Closes spring-projectsgh-31168
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sdeleuze sdeleuze

Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: backport An issue that is a backport of another issue to a maintenance branch type: documentation A documentation task
Projects
None yet
Milestone
5.3.30
Development

No branches or pull requests
1 participant
@sdeleuze