Interface CorsAuthorizer

public interface CorsAuthorizer

Contract for types that authorize CORS requests.

Standard implementations can be acquired via these factory methods:

• withRejectAllPolicy() (don't permit CORS requests)
• withAcceptAllPolicy() (permit all CORS requests, not recommended for production)
• withWhitelistedOrigins(Set) (permit whitelisted origins only)
• withWhitelistAuthorizer(Function) (permit origins via function)

See https://www.soklet.com/docs/cors#authorizing-cors-requests for detailed documentation.

Author:

Mark Allen

Method Summary

Modifier and Type	Method	Description
Optional<CorsResponse>	authorize(Request request, Cors cors)	Authorizes a non-preflight CORS request.
Optional<CorsPreflightResponse>	authorizePreflight(Request request, CorsPreflight corsPreflight, Map<HttpMethod, ResourceMethod> availableResourceMethodsByHttpMethod)	Authorizes a CORS preflight request.
static CorsAuthorizer	withAcceptAllPolicy()
static CorsAuthorizer	withRejectAllPolicy()
static CorsAuthorizer	withWhitelistAuthorizer(Function<String,Boolean> whitelistAuthorizer)
static CorsAuthorizer	withWhitelistedOrigins(Set<String> whitelistedOrigins)

Method Details

authorize

@Nonnull
Optional<CorsResponse> authorize(@Nonnull
 Request request,
 @Nonnull
 Cors cors)

Authorizes a non-preflight CORS request.

Parameters:

request - the request to authorize

cors - the CORS data provided in the request

Returns:

a CorsResponse if authorized, or Optional.empty() if not authorized

authorizePreflight

@Nonnull
Optional<CorsPreflightResponse> authorizePreflight(@Nonnull
 Request request,
 @Nonnull
 CorsPreflight corsPreflight,
 @Nonnull
 Map<HttpMethod, ResourceMethod> availableResourceMethodsByHttpMethod)

Authorizes a CORS preflight request.

Parameters:

request - the preflight request to authorize

corsPreflight - the CORS preflight data provided in the request

availableResourceMethodsByHttpMethod - Resource Methods that are available to serve requests according to parameters specified by the preflight data

Returns:

a CorsPreflightResponse if authorized, or Optional.empty() if not authorized

withAcceptAllPolicy

@Nonnull
static CorsAuthorizer withAcceptAllPolicy()

withRejectAllPolicy

@Nonnull
static CorsAuthorizer withRejectAllPolicy()

withWhitelistedOrigins

@Nonnull
static CorsAuthorizer withWhitelistedOrigins(@Nonnull
 Set<String> whitelistedOrigins)

withWhitelistAuthorizer

@Nonnull
static CorsAuthorizer withWhitelistAuthorizer(@Nonnull
 Function<String,Boolean> whitelistAuthorizer)