org.springframework.web.servlet.config.annotation

## Class CorsRegistration

- java.lang.Object
- - org.springframework.web.servlet.config.annotation.CorsRegistration

-     public class CorsRegistration
      extends Object

  Assists with the creation of a `CorsConfiguration` instance for a given URL path pattern.
  Since:
    4.2
  Author:
    Sebastien Deleuze, Rossen Stoyanchev, Sam Brannen
  See Also:
    `CorsConfiguration`, `CorsRegistry`

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `CorsRegistration(String pathPattern)`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `CorsRegistration` | `allowCredentials(boolean allowCredentials)` Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint.
    `CorsRegistration` | `allowedHeaders(String... headers)` Set the list of headers that a pre-flight request can list as allowed for use during an actual request.
    `CorsRegistration` | `allowedMethods(String... methods)` Set the HTTP methods to allow, e.g.
    `CorsRegistration` | `allowedOriginPatterns(String... patterns)` Alternative to `allowedOrigins(String...)` that supports more flexible patterns for specifying the origins for which cross-origin requests are allowed from a browser.
    `CorsRegistration` | `allowedOrigins(String... origins)` Set the origins for which cross-origin requests are allowed from a browser.
    `CorsRegistration` | `allowPrivateNetwork(boolean allowPrivateNetwork)` Whether private network access is supported.
    `CorsRegistration` | `combine(CorsConfiguration other)` Apply the given `CorsConfiguration` to the one being configured via `CorsConfiguration.combine(CorsConfiguration)` which in turn has been initialized with `CorsConfiguration.applyPermitDefaultValues()`.
    `CorsRegistration` | `exposedHeaders(String... headers)` Set the list of response headers that an actual response might have and can be exposed.
    `protected CorsConfiguration` | `getCorsConfiguration()`
    `protected String` | `getPathPattern()`
    `CorsRegistration` | `maxAge(long maxAge)` Configure how long in seconds the response from a pre-flight request can be cached by clients.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### CorsRegistration

          public CorsRegistration(String pathPattern)

  - ### Method Detail

    - #### allowedOrigins

          public CorsRegistration allowedOrigins(String... origins)

      Set the origins for which cross-origin requests are allowed from a browser. Please, refer to `CorsConfiguration.setAllowedOrigins(List)` for format details and other considerations.

      By default, all origins are allowed, but if `allowedOriginPatterns` is also set, then that takes precedence.

      See Also:
        `allowedOriginPatterns(String...)`

    - #### allowedOriginPatterns

          public CorsRegistration allowedOriginPatterns(String... patterns)

      Alternative to `allowedOrigins(String...)` that supports more flexible patterns for specifying the origins for which cross-origin requests are allowed from a browser. Please, refer to `CorsConfiguration.setAllowedOriginPatterns(List)` for format details and other considerations.

      By default this is not set.

      Since:
        5.3

    - #### allowedMethods

          public CorsRegistration allowedMethods(String... methods)

      Set the HTTP methods to allow, e.g. `"GET"`, `"POST"`, etc. The special value `"*"` allows all methods. By default, "simple" methods `GET`, `HEAD`, and `POST` are allowed.

      Please, see `CorsConfiguration.setAllowedMethods(List)` for details.

    - #### allowedHeaders

          public CorsRegistration allowedHeaders(String... headers)

      Set the list of headers that a pre-flight request can list as allowed for use during an actual request. The special value `"*"` may be used to allow all headers.

      Please, see `CorsConfiguration.setAllowedHeaders(List)` for details.

      By default all headers are allowed.

    - #### exposedHeaders

          public CorsRegistration exposedHeaders(String... headers)

      Set the list of response headers that an actual response might have and can be exposed. The special value `"*"` allows all headers to be exposed.

      Please, see `CorsConfiguration.setExposedHeaders(List)` for details.

      By default this is not set.

    - #### allowCredentials

          public CorsRegistration allowCredentials(boolean allowCredentials)

      Whether the browser should send credentials, such as cookies along with cross domain requests, to the annotated endpoint. The configured value is set on the `Access-Control-Allow-Credentials` response header of preflight requests.

      NOTE: Be aware that this option establishes a high level of trust with the configured domains and also increases the surface attack of the web application by exposing sensitive user-specific information such as cookies and CSRF tokens.

      By default this is not set in which case the `Access-Control-Allow-Credentials` header is also not set and credentials are therefore not allowed.

    - #### allowPrivateNetwork

          public CorsRegistration allowPrivateNetwork(boolean allowPrivateNetwork)

      Whether private network access is supported.

      By default this is not set (i.e. private network access is not supported).

      Since:
        5.3.32
      See Also:
        Private network access specifications

    - #### maxAge

          public CorsRegistration maxAge(long maxAge)

      Configure how long in seconds the response from a pre-flight request can be cached by clients.

      By default this is set to 1800 seconds (30 minutes).

    - #### combine

          public CorsRegistration combine(CorsConfiguration other)

      Apply the given `CorsConfiguration` to the one being configured via `CorsConfiguration.combine(CorsConfiguration)` which in turn has been initialized with `CorsConfiguration.applyPermitDefaultValues()`.
      Parameters:
        `other` - the configuration to apply
      Since:
        5.3

    - #### getPathPattern

          protected String getPathPattern()

    - #### getCorsConfiguration

          protected CorsConfiguration getCorsConfiguration()