OPTIONS请求中奇怪的“允许”标头发送到启用了CORS的Spring Boot端点

Question

To test this, one can use the sample code from https://spring.io/guides/gs/rest-service-cors/ with no changes.

Here's the output from an OPTIONS request without any CORS headers:

$ curl -X OPTIONS -i http://localhost:8080/greeting                                                                                                              HTTP/1.1 200 
Allow: GET,HEAD,OPTIONS
Content-Length: 0
Date: Wed, 24 Jul 2019 16:45:25 GMT

As expected, the Allow header is correct, as the method is annotated with @GetMapping .

But now let's simulate a CORS preflight OPTIONS request (which is not really necessary for a GET, but that's not the point), adding Origin and Access-Control-Request-Method :

$ curl -X OPTIONS -H'Origin: http://localhost:9000' -H'Access-Control-Request-Method: GET' -i http://localhost:8080/greeting
HTTP/1.1 200 
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Access-Control-Allow-Origin: http://localhost:9000
Access-Control-Allow-Methods: GET
Access-Control-Max-Age: 1800
Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
Content-Length: 0
Date: Wed, 24 Jul 2019 16:48:36 GMT

The CORS headers have been correctly included, but note that Allow now lists more methods than actually allowed (and which are indeed not allowed, with or without CORS; a 405 "Method not allowed" error is returned if one tries to POST to that URL).

Even more strange, Access-Control-Allow-Methods correctly lists only GET .

Am I misunderstanding some detail about how CORS should work, or is this a bug in Spring Boot?

Answer 1

Allow

The Allow header lists the set of methods support by a resource.

Access-Control-Allow-Methods

The Access-Control-Allow-Methods response header specifies the method or methods allowed when accessing the resource in response to a preflight request.

Allow just states what methods that are in general supported by the spring boot application. While Access-Control-Allow-Methods tells you what methods that you have access to.

Answer 2

As @Thomas stated allow is a Resource response header So if you look closely at the @RequestMapping properties you will see method : RequestMethod[] https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/bind/annotation/RequestMapping.html#method--

If you go to RequestMethod docs you will find the following :

Java 5 enumeration of HTTP request methods. Intended for use with the RequestMapping.method() attribute of the RequestMapping annotation. Note that, by default, DispatcherServlet supports GET, HEAD, POST, PUT, PATCH and DELETE only. DispatcherServlet will process TRACE and OPTIONS with the default HttpServlet behavior unless explicitly told to dispatch those request types as well: Check out the "dispatchOptionsRequest" and "dispatchTraceRequest" properties, switching them to "true" if necessary.

So by default @RequestMapping will allow [GET, HEAD, POST, PUT, PATCH , DELETE] If you want to restrict some resource or method for specific methods you can use

@RequestMapping(method = {RequestMethod.GET,RequestMethod.POST})