RegexCorsConfiguration - always calls the super class method

[nooscraft]

I'm trying to use your RegexCorsConfiguration I have kind of the same implementation as you except I expose CorsFilter using a FilterRegistrationBean and via @Bean annotation.

        @Bean
        FilterRegistrationBean corsFilter() {
          UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          CorsConfiguration config = new RegexCorsConfiguration();
          config.setAllowCredentials(true);

          this.corsSettings.getAllowedHeaders().forEach(config::addAllowedHeader);
          this.corsSettings.getAllowedMethods().forEach(config::addAllowedMethod);
          this.corsSettings.getAllowedOrigins().forEach(config::addAllowedOrigin);

          source.registerCorsConfiguration("/**", config);
          FilterRegistrationBean bean = new FilterRegistrationBean<>(new CorsFilter(source));
          bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
          return bean;
        }

But for some reason, it always calls the superclass implementation of the checkOrigin method. Do you have any idea about this? Appreciate your feedback

[looorent]

Hi @RockyRx ,

RegexCorsConfiguration redefines checkOrigin like this:

spring-security-jwt/src/main/java/be/looorent/security/jwt/RegexCorsConfiguration.java

Lines 48 to 52 in bf0dac1

	@Override
	public String checkOrigin(String requestOrigin) {
	String result = super.checkOrigin(requestOrigin);
	return result != null ? result : checkOriginWithRegularExpression(requestOrigin);
	}

This means before checking the origin based on a regular expression, it initially checks whether the origin already meets some basic CORS checks (for instance, if you allow "*" in your CORS configuration, your regex won't be used).

If you actually want to avoid this basic CORS check, you could extend RegexCorsConfiguration.checkOrigin to not call super.checkOrigin in checkOrigin.

[nooscraft]

@looorent

Thanks for the quick response.

I tried commenting off the super.checkOrigin in checkOrigin, but still, it calls the superclass method. I think I have done something fundamentally wrong here but still could not figure it out.

  @Nullable
  public String checkOrigin(String requestOrigin) {
//    String result = super.checkOrigin(requestOrigin);
    return checkOriginWithRegularExpression(requestOrigin);
  }

[looorent]

Would you have a repository with a working example? So I could debug it by myself and identifies why there is a unexpected check.