CODEWITHSUNDEEP
cross-domainspring-restcross-origin-read-blockingsecurity-testing
PAA
PAA

Reputation: 12045

Spring REST Security Testing - Cross Origin Issue

I am working on Spring Boot and Spring Rest application. The Security Testing have reported the issue

"The web application or services inform web client of the allowed domain using the HTTP response header Access-Control-Allow-Origin. The header can contain a '*' to indicate that all domain are allowed."

Remediation -

Use the Access-Control-Allow-Origin header only on chosen URLs that need to be accessed cross-domain. Don't use the header for the whole domain.

While making the HTTP request, they've used origin: null, then Access-Control-Allow-Origin: *

How can I implement this?

Upvotes: 0

Views: 123

Answers (1)

Amir Pezeshk
Amir Pezeshk

Reputation: 395

use this in your project, I think it will solve your problem,

import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class Filter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "authorization, content-type, xsrf-token, token");
        response.addHeader("Access-Control-Expose-Headers", "xsrf-token");

        if ("OPTIONS".equals(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else {
            filterChain.doFilter(request, response);
        }
    }


}

Upvotes: 1

Related Questions