By default, all origins and headers are permitted. * * @author Russell Allen * @author Sebastien Deleuze + * @author Sam Brannen * @since 4.2 */ -@Target({ElementType.METHOD, ElementType.TYPE}) +@Target({ ElementType.METHOD, ElementType.TYPE }) @Retention(RetentionPolicy.RUNTIME) @Documented public @interface CrossOrigin { /** - * List of allowed origins. {@code "*"} means that all origins are allowed. These values - * are placed in the {@code Access-Control-Allow-Origin} header of both the pre-flight - * and actual responses. Default value is "*". + * List of allowed origins. + *
These values are placed in the {@code Access-Control-Allow-Origin} + * header of both the pre-flight response and the actual response. + *
Defaults to {@code "*"} which means that all origins are allowed. */ String[] origin() default {"*"}; /** - * Indicates which request headers can be used during the actual request. {@code "*"} means - * that all headers asked by the client are allowed. This property controls the value of - * pre-flight response's {@code Access-Control-Allow-Headers} header. Default value is - * "*". + * List of request headers that can be used during the actual request. + *
This property controls the value of the pre-flight response's + * {@code Access-Control-Allow-Headers} header. + *
Defaults to {@code "*"} which means that all headers requested + * by the client are allowed. */ String[] allowedHeaders() default {"*"}; /** - * List of response headers that the user-agent will allow the client to access. This property - * controls the value of actual response's {@code Access-Control-Expose-Headers} header. + * List of response headers that the user-agent will allow the client to access. + *
This property controls the value of actual response's + * {@code Access-Control-Expose-Headers} header. + *
Defaults to an empty array. */ String[] exposedHeaders() default {}; /** - * The HTTP request methods to allow: GET, POST, HEAD, OPTIONS, PUT, PATCH, DELETE, TRACE. - * Methods specified here overrides {@code RequestMapping} ones. + * List of supported HTTP request methods. + *
Methods specified here override those specified via {@code RequestMapping}. + *
Defaults to an empty array. */ RequestMethod[] method() default {}; /** - * Set to {@code "true"} if the the browser should include any cookies associated to the domain - * of the request being annotated, or "false" if it should not. Empty string "" means undefined. - * If true, the pre-flight response will include the header - * {@code Access-Control-Allow-Credentials=true}. Default value is "true". + * Whether the browser should include any cookies associated with the + * domain of the request being annotated. + *
Set to {@code "false"} if such cookies should not included. + *
An empty string ({@code ""}) means undefined. + *
Defaults to {@code "true"} which means that the pre-flight + * response will include the header + * {@code Access-Control-Allow-Credentials=true}. */ String allowCredentials() default "true"; /** - * Controls the cache duration for pre-flight responses. Setting this to a reasonable - * value can reduce the number of pre-flight request/response interaction required by - * the browser. This property controls the value of the {@code Access-Control-Max-Age header} - * in the pre-flight response. Value set to -1 means undefined. Default value is - * 1800 seconds, or 30 minutes. + * The maximum age (in seconds) of the cache duration for pre-flight responses. + *
This property controls the value of the {@code Access-Control-Max-Age} + * header in the pre-flight response. + *
A value of {@code -1} means undefined. + *
Setting this to a reasonable value can reduce the number of pre-flight + * request/response interactions required by the browser. + *
Defaults to {@code 1800} seconds (i.e., 30 minutes). */ long maxAge() default 1800;