GitHub PushEvent at 2014-10-24 10:17:14
Repository: spring-framework
Actor: sdeleuze
Payload: {"shas":[["f841553a67bb0563ae5f6a8213cef7723228153f","e8b5bee66e35c0361db72ae98d0619cd426c2dbe@pivotal.io","Add an option to set an Origin whitelist for Websocket and SockJS\n\nThis commit introduces a new OriginHandshakeInterceptor. It filters\nOrigin header value against a list of allowed origins.\n\nAbstractSockJsService as been modified to:\n - Reject CORS requests with forbidden origins\n - Disable transport types that does not support CORS when an origin\n   check is required\n - Use the Origin request header value instead of \"*\" for\n   Access-Control-Allow-Origin response header value\n   (mandatory when  Access-Control-Allow-Credentials=true)\n - Return CORS header only if the request contains an Origin header\n\nIt is possible to configure easily this behavior thanks to JavaConfig API\nWebSocketHandlerRegistration#setAllowedOrigins(String...) and\nStompWebSocketEndpointRegistration#setAllowedOrigins(String...).\nIt is also possible to configure it using the websocket XML namespace.\n\nPlease notice that this commit does not change the default behavior:\ncross origin requests are enabled by default.\n\nIssues: SPR-12226","Sebastien Deleuze",true]],"size":1,"ref":"refs/heads/SPR-12226","head":"f841553a67bb0563ae5f6a8213cef7723228153f"}