fix cors support

akirasosa · akirasosa · commit d00575b45d4c · 2016-10-11T21:53:00.000+07:00
diff --git a/src/main/java/com/myapp/auth/SecurityConfig.java b/src/main/java/com/myapp/auth/SecurityConfig.java
@@ -14,21 +14,26 @@
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.filter.CorsFilter;
 
 @Configuration
 @EnableWebSecurity
 @Order(1)
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
-    final private UserService userService;
+    private final UserService userService;
 
-    final private TokenAuthenticationService tokenAuthenticationService;
+    private final TokenAuthenticationService tokenAuthenticationService;
+    private final CorsFilter corsFilter;
 
     @Autowired
-    public SecurityConfig(UserService userService, TokenAuthenticationService tokenAuthenticationService) {
+    public SecurityConfig(UserService userService,
+                          TokenAuthenticationService tokenAuthenticationService,
+                          CorsFilter corsFilter) {
         super(true);
         this.userService = userService;
         this.tokenAuthenticationService = tokenAuthenticationService;
+        this.corsFilter = corsFilter;
     }
 
     @Override
@@ -47,11 +52,15 @@ protected void configure(HttpSecurity http) throws Exception {
                 .antMatchers(HttpMethod.GET, "/api/users").hasRole("USER")
                 .antMatchers(HttpMethod.GET, "/api/users/me").hasRole("USER")
                 .antMatchers(HttpMethod.GET, "/api/users/me/microposts").hasRole("USER")
-                .antMatchers("/api/microposts/**").hasRole("USER")
-                .antMatchers("/api/relationships/**").hasRole("USER")
-                .antMatchers("/api/feed").hasRole("USER")
+                .antMatchers(HttpMethod.POST, "/api/microposts/**").hasRole("USER")
+                .antMatchers(HttpMethod.DELETE, "/api/microposts/**").hasRole("USER")
+                .antMatchers(HttpMethod.POST, "/api/relationships/**").hasRole("USER")
+                .antMatchers(HttpMethod.DELETE, "/api/relationships/**").hasRole("USER")
+                .antMatchers(HttpMethod.GET, "/api/feed").hasRole("USER")
+                .antMatchers(HttpMethod.OPTIONS, "/api/**").permitAll()
         ;
 
+        http.addFilterBefore(corsFilter, UsernamePasswordAuthenticationFilter.class);
         http.addFilterBefore(
                 new StatelessLoginFilter(
                         "/api/login",
diff --git a/src/main/java/com/myapp/config/CORSConfig.java b/src/main/java/com/myapp/config/CORSConfig.java
diff --git a/src/main/java/com/myapp/config/CorsConfig.java b/src/main/java/com/myapp/config/CorsConfig.java
@@ -0,0 +1,27 @@
+package com.myapp.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+import org.springframework.web.filter.CorsFilter;
+
+import static java.util.Arrays.asList;
+
+@Configuration
+public class CorsConfig {
+
+    @Bean
+    public CorsFilter corsFilter() {
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        CorsConfiguration config = new CorsConfiguration();
+        config.addAllowedOrigin("*");
+        config.setAllowedMethods(asList("GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"));
+        config.setAllowedHeaders(asList("x-auth-token", "content-type"));
+        config.addExposedHeader("x-auth-token");
+        config.setMaxAge(864000L);
+        source.registerCorsConfiguration("/api/**", config);
+        return new CorsFilter(source);
+    }
+
+}
