Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 17:57:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add Support for PreFlightRequestFilter

Browse Source 
Closes gh-18926
This commit is contained in:
Robert Winch
2026-03-19 14:56:46 -05:00
committed by Rob Winch
parent 0ef8a4ff27
commit 4199240662
8 changed files with 538 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/modules/ROOT/pages/servlet/integrations/cors.adoc
+17
View File
@@ -184,6 +184,23 @@ fun corsConfigurationSource(): UrlBasedCorsConfigurationSource {
----
======
[[cors-preflight-request-handler]]
== `PreFlightRequestHandler` and `PreFlightRequestFilter`
Spring Framework defines {spring-framework-api-url}org/springframework/web/cors/PreFlightRequestHandler.html[`PreFlightRequestHandler`] for applications that need to handle CORS preflight (`OPTIONS`) requests outside of `CorsFilter`.
When Spring Security selects a `PreFlightRequestHandler` for a filter chain, it registers {spring-framework-api-url}org/springframework/web/filter/PreFlightRequestFilter.html[`PreFlightRequestFilter`] in the security filter chain (before `CorsFilter`) so preflight can be handled early in the request lifecycle.
You can supply a handler in either of these ways:
* Pass a handler directly with the `preFlightRequestHandler` attribute.
* Register a `PreFlightRequestHandler` bean when cors is enabled and when no `CorsConfigurationSource` or `CorsFilter` is chosen for that chain.
You must not configure both `configurationSource` and `preFlightRequestHandler` on the same `CorsConfigurer`; doing so results in an error at startup.
The following example explicitly registers a `PreFlightRequestHandler` using the `preFlightRequestHandler`:
include-code::./CorsPreFlightRequestHandlerExample[tag=preflightRequestHandler,indent=0]
[WARNING]
====
CORS is a browser-based security feature.
docs/modules/ROOT/pages/whats-new.adoc
+1
View File
@@ -8,6 +8,7 @@
* Added xref:servlet/authorization/architecture.adoc#authz-conditional-authorization-manager[ConditionalAuthorizationManager]
* Added `when` and `withWhen` conditions to `AuthorizationManagerFactories.multiFactor()` for xref:servlet/authentication/mfa.adoc#programmatic-mfa[Programmatic MFA]
* Added `MultiFactorCondition.WEBAUTHN_REGISTERED` to `@EnableMultiFactorAuthentication(when = ...)` for xref:servlet/authentication/mfa.adoc#mfa-when-webauthn-registered[conditionally requiring MFA for WebAuthn Users]
* https://github.com/spring-projects/spring-security/issues/18926[gh-18926] - xref:servlet/integrations/cors.adoc[Add `PreFlightRequestFilter` Support]
== OAuth 2.0