1 /*
2 * Copyright 2012-2025 CodeLibs Project and the Others.
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
13 * either express or implied. See the License for the specific language
14 * governing permissions and limitations under the License.
15 */
16 package org.codelibs.fess.cors;
17
18 import org.codelibs.fess.mylasta.direction.FessConfig;
19 import org.codelibs.fess.util.ComponentUtil;
20
21 import jakarta.annotation.PostConstruct;
22 import jakarta.servlet.ServletRequest;
23 import jakarta.servlet.ServletResponse;
24 import jakarta.servlet.http.HttpServletResponse;
25
26 /**
27 * Default implementation of CORS (Cross-Origin Resource Sharing) handler.
28 * This handler automatically registers itself for origins configured in the system
29 * and applies standard CORS headers based on the application configuration.
30 */
31 public class DefaultCorsHandler extends CorsHandler {
32
33 /**
34 * Creates a new instance of DefaultCorsHandler.
35 * This constructor initializes the default CORS handler for applying
36 * standard CORS headers based on application configuration.
37 */
38 public DefaultCorsHandler() {
39 super();
40 }
41
42 /**
43 * Registers this CORS handler with the factory for configured allowed origins.
44 * This method is automatically called after bean initialization.
45 */
46 @PostConstruct
47 public void register() {
48 final CorsHandlerFactory factory = ComponentUtil.getCorsHandlerFactory();
49 final FessConfig fessConfig = ComponentUtil.getFessConfig();
50 fessConfig.getApiCorsAllowOriginList().forEach(s -> factory.add(s, this));
51 }
52
53 /**
54 * Processes the CORS request by adding standard CORS headers to the response.
55 * Headers include allowed origin, methods, headers, max age, and credentials setting.
56 *
57 * @param origin the origin of the request
58 * @param request the servlet request
59 * @param response the servlet response to add CORS headers to
60 */
61 @Override
62 public void process(final String origin, final ServletRequest request, final ServletResponse response) {
63 final FessConfig fessConfig = ComponentUtil.getFessConfig();
64 final HttpServletResponse httpResponse = (HttpServletResponse) response;
65 httpResponse.addHeader(ACCESS_CONTROL_ALLOW_ORIGIN, origin);
66 httpResponse.addHeader(ACCESS_CONTROL_ALLOW_METHODS, fessConfig.getApiCorsAllowMethods());
67 httpResponse.addHeader(ACCESS_CONTROL_ALLOW_HEADERS, fessConfig.getApiCorsAllowHeaders());
68 httpResponse.addHeader(ACCESS_CONTROL_MAX_AGE, fessConfig.getApiCorsMaxAge());
69 httpResponse.addHeader(ACCESS_CONTROL_ALLOW_CREDENTIALS, fessConfig.getApiCorsAllowCredentials());
70 }
71
72 }