hazza/DSpace
1
0
Fork 0
mirror of https://github.com/DSpace/DSpace.git synced 2025-10-17 15:03:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Correct the default allowed-origins in rest.cfg. Enhance comments in rest.cfg & Application

Browse Source
This commit is contained in:
Tim Donohue
2020-04-02 14:27:54 -05:00
parent d3d4ff9094
commit 1f07d465a2
2 changed files with 27 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
dspace-server-webapp/src/main/java/org/dspace/app/rest/Application.java
View File

@@ -126,6 +126,10 @@ public class Application extends SpringBootServletInitializer {
public WebMvcConfigurer webMvcConfigurer() { public WebMvcConfigurer webMvcConfigurer() {
return new WebMvcConfigurer() { return new WebMvcConfigurer() {
/**
* Create a custom CORS mapping for the DSpace REST API (/api/ paths), based on configured allowed origins.
* @param registry CorsRegistry
*/
@Override @Override
public void addCorsMappings(@NonNull CorsRegistry registry) { public void addCorsMappings(@NonNull CorsRegistry registry) {
String[] corsAllowedOrigins = configuration.getCorsAllowedOrigins(); String[] corsAllowedOrigins = configuration.getCorsAllowedOrigins();

7
dspace/config/modules/rest.cfg
View File

@@ -3,10 +3,11 @@
#---------------------------------------------------------------# #---------------------------------------------------------------#
# These configs are used by the RESTv7 module # # These configs are used by the RESTv7 module #
#---------------------------------------------------------------# #---------------------------------------------------------------#
# Allowed CORS origins. Defaults to * (everywhere) # Allowed CORS origins ("Access-Control-Allow-Origin" header).
# Multiple allowed origin URLs may be comma separated # Defaults to ${dspace.ui.url} if unspecified.
# Multiple allowed origin URLs may be comma separated. Wildcard value (*) is *NOT SUPPORTED*.
# (Requires reboot of servlet container, e.g. Tomcat, to reload) # (Requires reboot of servlet container, e.g. Tomcat, to reload)
rest.cors.allowed-origins = * rest.cors.allowed-origins = ${dspace.ui.url}
# This property determines the max embeddepth for a FullProjection. This is also used by the SpecificLevelProjection # This property determines the max embeddepth for a FullProjection. This is also used by the SpecificLevelProjection
# as a fallback in case the property is defined on the bean # as a fallback in case the property is defined on the bean