GitHub PushEvent at 2014-10-26 21:11:04
Repository: spring-framework
Actor: sdeleuze
Payload: {"shas":[["743356fa217dc093d6ade8a1867e0bb6ccb22a80","e8b5bee66e35c0361db72ae98d0619cd426c2dbe@pivotal.io","Add an option to set an Origin whitelist for Websocket and SockJS\n\nThis commit introduces a new OriginHandshakeInterceptor. It filters\nOrigin header value against a list of allowed origins.\n\nAbstractSockJsService as been modified to:\n - Reject CORS requests with forbidden origins\n - Disable transport types that does not support CORS when an origin\n   check is required\n - Use the Origin request header value instead of \"*\" for\n   Access-Control-Allow-Origin response header value\n   (mandatory when  Access-Control-Allow-Credentials=true)\n - Return CORS header only if the request contains an Origin header\n\nIt is possible to configure easily this behavior thanks to JavaConfig API\nWebSocketHandlerRegistration#addAllowedOrigins(String...) and\nStompWebSocketEndpointRegistration#addAllowedOrigins(String...).\nIt is also possible to configure it using the websocket XML namespace.\n\nPlease notice that this commit does not change the default behavior:\ncross origin requests are still enabled by default.\n\nIssues: SPR-12226","Sebastien Deleuze",true],["58f4014b17018e0eeb68d78de3275627f009e46c","e8b5bee66e35c0361db72ae98d0619cd426c2dbe@pivotal.io","Add an option to disable automatic addition of CORS header\n\nIssues: SPR-12283","Sebastien Deleuze",true]],"size":2,"ref":"refs/heads/SPR-12283","head":"58f4014b17018e0eeb68d78de3275627f009e46c"}