FINERACT-2326: Add configuration options for CORS handling

adamsaghy · adamsaghy · commit 83916143300c · 2025-12-08T10:23:17.000+01:00
diff --git a/fineract-core/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java b/fineract-core/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java
@@ -519,6 +519,7 @@ public static class FineractSecurityProperties {
         private FineractSecurityTwoFactorAuth twoFactor;
         private FineractSecurityHsts hsts;
         private FineractSecurityOAuth2Properties oauth2;
+        private CorsProperties cors;
 
         public void set2fa(FineractSecurityTwoFactorAuth twoFactor) {
             this.twoFactor = twoFactor;
@@ -688,4 +689,16 @@ public static class ExecuteCommandProperties {
             }
         }
     }
+
+    @Getter
+    @Setter
+    public static class CorsProperties {
+
+        private boolean enabled;
+        private List<String> allowedOrigins;
+        private List<String> allowedMethods;
+        private List<String> allowedHeaders;
+        private List<String> exposedHeaders;
+        private boolean allowCredentials;
+    }
 }
diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/SecurityConfig.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/SecurityConfig.java
@@ -160,8 +160,8 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                             .requestMatchers(antMatcher("/api/**"))
                             .access(allOf(authorizationManagers.toArray(new AuthorizationManager[0]))); //
                 }).httpBasic((httpBasic) -> httpBasic.authenticationEntryPoint(basicAuthenticationEntryPoint())) //
-                .cors(Customizer.withDefaults()).csrf(AbstractHttpConfigurer::disable) // NOSONAR only creating a
-                                                                                       // service that
+                .csrf(AbstractHttpConfigurer::disable) // NOSONAR only creating a
+                                                       // service that
                 // is used by non-browser clients
                 .sessionManagement((smc) -> smc.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) //
                 .addFilterBefore(tenantAwareBasicAuthenticationFilter(), SecurityContextHolderFilter.class) //
@@ -189,6 +189,9 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
             http.requiresChannel(channel -> channel.anyRequest().requiresSecure()).headers(
                     headers -> headers.httpStrictTransportSecurity(hsts -> hsts.includeSubDomains(true).maxAgeInSeconds(31536000)));
         }
+        if (fineractProperties.getSecurity().getCors().isEnabled()) {
+            http.cors(Customizer.withDefaults());
+        }
         return http.build();
     }
 
@@ -258,13 +261,16 @@ public AuthenticationManager authenticationManagerBean() throws Exception {
 
     @Bean
     public CorsConfigurationSource corsConfigurationSource() {
-        CorsConfiguration configuration = new CorsConfiguration();
-        configuration.setAllowedOriginPatterns(List.of("*"));
-        configuration.setAllowedMethods(List.of("*"));
-        configuration.setAllowCredentials(true);
-        configuration.setAllowedHeaders(List.of("*"));
+        CorsConfiguration config = new CorsConfiguration();
+        FineractProperties.CorsProperties corsConfiguration = fineractProperties.getSecurity().getCors();
+        config.setAllowedOrigins(corsConfiguration.getAllowedOrigins());
+        config.setAllowedMethods(corsConfiguration.getAllowedMethods());
+        config.setAllowedHeaders(corsConfiguration.getAllowedHeaders());
+        config.setExposedHeaders(corsConfiguration.getExposedHeaders());
+        config.setAllowCredentials(corsConfiguration.isAllowCredentials()); // if you use cookies / Authorization header
+
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-        source.registerCorsConfiguration("/**", configuration);
+        source.registerCorsConfiguration("/**", config);
         return source;
     }
 }
diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/config/AuthorizationServerConfig.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/config/AuthorizationServerConfig.java
@@ -55,6 +55,7 @@
 import org.springframework.core.annotation.Order;
 import org.springframework.security.authentication.AuthenticationDetailsSource;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -78,6 +79,9 @@
 import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.context.SecurityContextHolderFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 import org.springframework.web.filter.OncePerRequestFilter;
 
 @Configuration
@@ -121,6 +125,10 @@ public SecurityFilterChain publicEndpoints(HttpSecurity http) throws Exception {
         http.securityMatcher("/swagger-ui/**", "/fineract.json", "/actuator/**", "/legacy-docs/apiLive.htm")
                 .authorizeHttpRequests(auth -> auth.anyRequest().permitAll()).csrf(AbstractHttpConfigurer::disable);
 
+        if (fineractProperties.getSecurity().getCors().isEnabled()) {
+            http.cors(Customizer.withDefaults());
+        }
+
         return http.build();
     }
 
@@ -137,14 +145,17 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
                 .exceptionHandling(exceptions -> exceptions.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login")))
                 .apply(authorizationServerConfigurer);
 
+        if (fineractProperties.getSecurity().getCors().isEnabled()) {
+            http.cors(Customizer.withDefaults());
+        }
+
         return http.build();
     }
 
     @Bean
     @Order(3)
     public SecurityFilterChain protectedEndpoints(HttpSecurity http) throws Exception {
         http
-                // .securityMatcher(new AntPathRequestMatcher("/api/**"))
                 // TODO: Make it configurable
                 .csrf(AbstractHttpConfigurer::disable).authorizeHttpRequests(auth -> {
                     auth.anyRequest().authenticated();
@@ -171,9 +182,27 @@ public SecurityFilterChain protectedEndpoints(HttpSecurity http) throws Exceptio
         if (fineractProperties.getSecurity().getTwoFactor().isEnabled()) {
             http.addFilterAfter(twoFactorAuthenticationFilter(), CorrelationHeaderFilter.class);
         }
+        if (fineractProperties.getSecurity().getCors().isEnabled()) {
+            http.cors(Customizer.withDefaults());
+        }
         return http.build();
     }
 
+    @Bean
+    public CorsConfigurationSource corsConfigurationSource() {
+        CorsConfiguration config = new CorsConfiguration();
+        FineractProperties.CorsProperties corsConfiguration = fineractProperties.getSecurity().getCors();
+        config.setAllowedOrigins(corsConfiguration.getAllowedOrigins());
+        config.setAllowedMethods(corsConfiguration.getAllowedMethods());
+        config.setAllowedHeaders(corsConfiguration.getAllowedHeaders());
+        config.setExposedHeaders(corsConfiguration.getExposedHeaders());
+        config.setAllowCredentials(corsConfiguration.isAllowCredentials()); // if you use cookies / Authorization header
+
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", config);
+        return source;
+    }
+
     @Bean
     public OncePerRequestFilter tenantAwareAuthenticationFilter() {
         return new TenantAwareAuthenticationFilter(resolver(), tenantDetailsService);
diff --git a/fineract-provider/src/main/resources/application.properties b/fineract-provider/src/main/resources/application.properties
@@ -26,6 +26,14 @@ fineract.security.oauth2.enabled=${FINERACT_SECURITY_OAUTH_ENABLED:false}
 fineract.security.2fa.enabled=${FINERACT_SECURITY_2FA_ENABLED:false}
 fineract.security.hsts.enabled=${FINERACT_SECURITY_HSTS_ENABLED:false}
 
+#CORS configuration
+fineract.security.cors.enabled=${FINERACT_SECURITY_CORS_ENABLED:true}
+fineract.security.cors.allowed-origins=${FINERACT_SECURITY_CORS_ALLOWED_ORIGINS:"*"}
+fineract.security.cors.allowed-methods=${FINERACT_SECURITY_CORS_ALLOWED_METHODS:"*"}
+fineract.security.cors.allowed-headers=${FINERACT_SECURITY_CORS_ALLOWED_HEADERS:"*"}
+fineract.security.cors.exposed-headers=${FINERACT_SECURITY_CORS_EXPOSED_HEADERS:"*"}
+fineract.security.cors.allow-credentials=${FINERACT_SECURITY_CORS_ALLOW_CREDENTIALS:true}
+
 # EXAMPLE: OAuth2 client configuration (frontend-client)
 fineract.security.oauth2.client.registrations.frontend-client.client-id=${FINERACT_SECURITY_OAUTH2_CLIENTS_FRONTEND_ID:frontend-client}
 fineract.security.oauth2.client.registrations.frontend-client.scopes=${FINERACT_SECURITY_OAUTH2_CLIENTS_FRONTEND_SCOPES:read,write}
diff --git a/fineract-provider/src/test/resources/application-test.properties b/fineract-provider/src/test/resources/application-test.properties
@@ -25,6 +25,14 @@ fineract.security.oauth2.enabled=false
 fineract.security.2fa.enabled=false
 fineract.security.hsts.enabled=false
 
+#CORS configuration
+fineract.security.cors.enabled=true
+fineract.security.cors.allowed-origins="*"
+fineract.security.cors.allowed-methods="*"
+fineract.security.cors.allowed-headers="*"
+fineract.security.cors.exposed-headers="*"
+fineract.security.cors.allow-credentials=true
+
 fineract.tenant.host=localhost
 fineract.tenant.port=3306
 fineract.tenant.username=root

Original file line number	Diff line number	Diff line change
`@@ -519,6 +519,7 @@ public static class FineractSecurityProperties {`
`519`	`519`	`private FineractSecurityTwoFactorAuth twoFactor;`
`520`	`520`	`private FineractSecurityHsts hsts;`
`521`	`521`	`private FineractSecurityOAuth2Properties oauth2;`
	`522`	`+ private CorsProperties cors;`
`522`	`523`
`523`	`524`	`public void set2fa(FineractSecurityTwoFactorAuth twoFactor) {`
`524`	`525`	`this.twoFactor = twoFactor;`
`@@ -688,4 +689,16 @@ public static class ExecuteCommandProperties {`
`688`	`689`	`}`
`689`	`690`	`}`
`690`	`691`	`}`
	`692`	`+`
	`693`	`+ @Getter`
	`694`	`+ @Setter`
	`695`	`+ public static class CorsProperties {`
	`696`	`+`
	`697`	`+ private boolean enabled;`
	`698`	`+ private List<String> allowedOrigins;`
	`699`	`+ private List<String> allowedMethods;`
	`700`	`+ private List<String> allowedHeaders;`
	`701`	`+ private List<String> exposedHeaders;`
	`702`	`+ private boolean allowCredentials;`
	`703`	`+ }`
`691`	`704`	`}`