Spring Boot – CORS Support using XML Config
Tags: springboot, cors, xml
Published: 2021-04-21 10:54:47

https://grokonez.com/spring-framework/spring-boot/spring-boot-cors-support-using-xml-config

Spring Boot – CORS Support using XML Config

In previous <a href="https://grokonez.com/spring-framework/spring-boot/spring-cors-configuration-using-java-config-spring-boot">post</a>, we have created a REST Service with Global CORS Configuration using Java Config. This tutorial will introduce way to define global CORS configuration out of our Controller with XML Config in Spring Boot example.

Related Articles:
- <a href="https://grokonez.com/spring-framework/spring-boot/spring-cors-example-crossorigin-spring-boot">Spring CORS example using @CrossOrigin – Spring Boot</a>
- <a href="https://grokonez.com/spring-framework/spring-boot/spring-boot-cors-support-using-java-config">Spring Boot – CORS Support using Java Config</a>

<!--more-->
<h2>I. Global CORS Configuration using XML Config</h2>
Spring provides a way that uses XML Config applying for all REST Service Controllers in our project:
<pre><code class="language-html">&lt;mvc:cors&gt;
	&lt;mvc:mapping path=&quot;/customers&quot;
		allowed-origins=&quot;http://localhost:8484, http://localhost:9000&quot;
		allowed-methods=&quot;POST, GET, PUT, DELETE&quot;
		allowed-headers=&quot;Content-Type&quot;
		exposed-headers=&quot;header-1, header-2&quot;
		allow-credentials=&quot;false&quot;
		max-age=&quot;6000&quot; /&gt;
&lt;/mvc:cors&gt;</code></pre>
- <code>allowedOrigins</code>: specifies the URI that can be accessed by resource. "*" means that all origins are allowed. If undefined, all origins are allowed.

- <code>allowCredentials</code>: defines the value for <strong>Access-Control-Allow-Credentials</strong> response header. If value is true, response to the request can be exposed to the page. The credentials are cookies, authorization headers or TLS client certificates. The default value is <strong>true</strong>. 

- <code>maxAge</code>: defines maximum age (in seconds) for cache to be alive for a pre-flight request. By default, its value is 1800 seconds. 

- <code>allowedMethods</code>: specifies methods (GET, POST,...) to allow when accessing the resource. If we don't use this attribute, it takes the value of <code>@RequestMapping</code> method by default. If we specify methods, default method will be overridden. 

- <code>allowedHeaders</code>: defines the values for <strong>Access-Control-Allow-Headers</strong> response header. We don't need to list headers if it is one of <em>Cache-Control</em>, <em>Content-Language</em>, <em>Expires</em>, <em>Last-Modified</em>, or <em>Pragma</em>. By default all requested headers are allowed.

- <code>exposedHeaders</code>: values for <strong>Access-Control-Expose-Headers</strong> response header. Server uses it to tell the browser about its whitelist headers. By default, an empty exposed header list is used.
<h2>II. Practice</h2>
<h3>1. Technology</h3>
- Java 1.8
- Maven 3.3.9
- Spring Tool Suite – Version 3.8.4.RELEASE
- Spring Boot: 1.5.4.RELEASE
<h3>2. Project Overview</h3>
<img src="https://grokonez.com/wp-content/uploads/2017/06/spring-cors-xmlconfig-structure.png" alt="spring-cors-xmlconfig-structure" width="336" height="221" class="alignnone size-full wp-image-6020" />

https://grokonez.com/spring-framework/spring-boot/spring-boot-cors-support-using-xml-config

Spring Boot – CORS Support using XML Config