Skip to main content

CORS implementation using Java Filter

What is CORS

CORS is cross origin resource sharing which allows or block the cross domain calls from a web application between different domains. By default you are able to make Ajax calls to other domain. To enable it that provider also need to add certain headers to allow the requester domain.

CORS Headers

Below are the required headers to implement the CORS.
  1. Access-Control-Allow-Origin
  2. In this header we specify the domain from which we want to allow the access, for example: example.com.
  3. Access-Control-Allow-Credentials
  4. This header specifies if it can pass authorization details in cross domain request. for example: true/false.
  5. Access-Control-Max-Age
  6. We can use this header to specify how long we want to cache the preflight request details like allowed methods, allowed headers etc. We can specify value in seconds and we can cache them for a long time as such details are not change frequently.
  7. Access-Control-Allow-Methods
  8. Here we specify the methods we want to allow for request, for example: GET, POST, DELETE, OPTIONS, PATCH.
  9. Access-Control-Allow-Headers
  10. Here we specify the header names which are allowed during the request.

Java Filter Implementation

We will use Java filter to implement these CORS headers. We can implement this filter in java web application along with Spring, Struts or JSF frameworks also. However those frameworks have their own mechanism to implement CORS.
We have used a header "referer" here to get the requester domain, so we can allows cross-domain call by putting it in response header. Below is the complete code for Filter class.
public class CorsFilter implements Filter{
    @Override
    public void init(FilterConfig config){}

    @Override
    public void destroy(){}

    @Override
    public void doFilter(ServletRequest req, ServletResponse res,
                          FilterChain chain)throws ServletException, IOException{

        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        String referer = request.getHeader("referer");
        
        if(referer!=null && referer.length()>1){

            if(referer.endsWith("/")){
                referer = referer.substring(0, referer.length()-1);
            }
            response.addHeader("Access-Control-Allow-Origin", referer);
            response.addHeader("Access-Control-Allow-Credentials", "true");
            response.addHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
            response.addHeader("Access-Control-Allow-Headers", "x-requested-with,Content-Type,Access-Control-Allow-Methods,Access-Control-Allow-Origin");
            response.addHeader("Access-Control-Max-Age", "86400");//24 hours
        }
        
        chain.doFilter(request, response);
    }
}

Web config changes

We are ready with out filter code and now we need to register it using the web configuration (web.xml). Below is the code for filter registration.
        <filter>
            <filter-name>corsFilter</filter-name>
            <filter-class>com.ttj.web.cors.CorsFilter</filter-class>
        </filter>
        
        <filter-mapping>
            <filter-name>corsFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
Now if you call the configured URLs using java script/Ajax then it will populate the required response headers to allow the cross-domain access. Please note that the code I shown here, is configured to allow any domain. If you want to allow some specific then you can maintain some list of domains to check before setting the headers.

Comments

Post a comment

Popular Posts

SpringBoot - @ConditionalOnProperty example for conditional bean initialization

@ConditionalOnProperty annotation is used to check if specified property available in the environment or it matches some specific value so it can control the execution of some part of code like bean creation. It may be useful in many cases for example enable/disable service if specific property is available. Below are the attributes which can be used for property check.
havingValue - Provide the value which need to check against specified property otherwise it will check that value should not be false.matchIfMissing - If true it will match the condition and execute the annotated code when property itself is not available in environment.name - Name of the property to be tested. If you want to test single property then you can directly put the property name as string like "property.name" and if you have multiple properties to test then you can put the names like {"prop.name1","prop.name2"}prefix - It can be use when you want to apply some prefix to all prop…

Asynchronous REST service implementation in Spring boot

In this tutorial we will see how to create an asynchronous REST service endpoint using Spring boot application.
Asynchronous service works in a way that it will not block the client request and do the processing in separate thread. When work is complete the response returned to the client so our service will be able to handle more client requests at the same time, compare to synchronous processing model.
Let's understand how it is working in synchronous mode. In such server/client application at server side it has a pool of threads which are serving the request. If a request received by a thread then it will be blocked until it send the response back to client. In this case if processing doesn't take much time it will be able to process it quickly and accept other client requests but there could be one situation when all threads are busy and not able to accept the new client requests.

To overcome of such problems, asynchronous processing model introduced for REST services. In…

Entity to DTO conversion in Java using Jackson

It's very common to have the DTO class for a given entity in any application. When persisting data, we use entity objects and when we need to provide the data to end user/application we use DTO class. Due to this we may need to have similar properties on DTO class as we have in our Entity class and to share the data we populate DTO objects using entity objects. To do this we may need to call getter on entity and then setter on DTO for the same data which increases number of code line. Also if number of DTOs are high then we need to write lot of code to just get and set the values or vice-versa.
To overcome this problem we are going to use Jackson API and will see how to do it with minimal code only.
Maven dependency <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.9.9</version> </dependency> Entity class Below is our ent…

Web scraper using JSoup and Spring Boot

What is webscraping Webscraping is a technique to extract or pull the data from a website to gather required information by parsing the HTML source of their websites, such as articles from news or books site, products information from online shopping sites or course information from education sites. There are many organisations who uses web scraper to provide the best experience to their customers, for example extract the price for a smartphone from multiple online websites and show their customers the best and cheap product URL.
We will learn here how to code a web scraper by developing a simple new scraper service.
News scraper News scraper is used to extract the news articles or other related contents from a news site. Here we are going to create a web scraper application to pull the articles from news site.
Below are the operations provided by our news scraper service.
List all the authorsSearch articles by author nameSearch articles by article titleSearch articles by article desc…