Merge pull request #1248 from stormpath/1241_cors_fix_for_angular

1241 - Fixing CORS issue for Angular

Author: dogeared

extensions/servlet/src/main/resources/com/stormpath/sdk/servlet/config/web.stormpath.properties

@@ -354,5 +354,6 @@ stormpath.web.assets.css.enabled = true
 stormpath.web.cors.enabled = true
 #Comma separated list of allowed origins
 stormpath.web.cors.allowed.originUris =
-stormpath.web.cors.allowed.headers = Content-Type,Accept,X-Requested-With,remember-me
+stormpath.web.cors.allowed.headers = Content-Type,Accept,X-Requested-With,remember-me,authorization,x-stormpath-agent
 stormpath.web.cors.allowed.methods = POST,GET,OPTIONS,DELETE,PUT
+stormpath.web.cors.allow.credentials = true

extensions/servlet/src/test/groovy/com/stormpath/sdk/servlet/config/SpecConfigVersusWebPropertiesTest.groovy

@@ -85,7 +85,7 @@ class SpecConfigVersusWebPropertiesTest {
             specProperties.containsKey(k) ? null : k
         }
 
-        def expected_diff_size = 82
+        def expected_diff_size = 83
 
         if (diff.size != expected_diff_size) {
             println "It looks like a property was added or removed from the Framework Spec or web.stormpath.properties."

extensions/spring/boot/stormpath-spring-security-webmvc-spring-boot-starter/src/main/java/com/stormpath/spring/boot/autoconfigure/StormpathWebSecurityAutoConfiguration.java

@@ -150,8 +150,13 @@ public AuthenticationEntryPoint stormpathAuthenticationEntryPoint() {
     /**
      * @since 1.3.0
      */
+    /*
+     * We cannot add @ConditionalOnMissingBean here.
+     * When using the spring boot starter parent, it has a CorsConfigurationSource that would prevent this bean from being used.
+     * Fix for: https://github.com/stormpath/stormpath-sdk-java/issues/1241
+     */
     @Bean
-    @ConditionalOnMissingBean
+    @Override
     public CorsConfigurationSource corsConfigurationSource() {
         return super.corsConfigurationSource();
     }

extensions/spring/boot/stormpath-webmvc-spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json

@@ -1018,13 +1018,19 @@
       "name": "stormpath.web.cors.allowed.headers",
       "type": "java.lang.String",
       "description": "Comma separated list of allowed headers for a CORS request.",
-      "defaultValue": "Content-Type,Accept,X-Requested-With,remember-me"
+      "defaultValue": "Content-Type,Accept,X-Requested-With,remember-me,authorization,x-stormpath-agent"
     },
     {
       "name": "stormpath.web.cors.allowed.methods",
       "type": "java.lang.String",
       "description": "Comma separated list of allowed methods for a CORS request.",
       "defaultValue": "POST,GET,OPTIONS,DELETE,PUT"
+    },
+    {
+      "name": "stormpath.web.cors.allow.credentials",
+      "type": "java.lang.Boolean",
+      "description": "Whether user credentials are supported.",
+      "defaultValue": true
     }
   ]
 }

extensions/spring/stormpath-spring-security-webmvc/src/main/java/com/stormpath/spring/config/AbstractStormpathWebSecurityConfiguration.java

@@ -129,12 +129,15 @@ public abstract class AbstractStormpathWebSecurityConfiguration {
     @Value("#{ @environment['stormpath.web.cors.allowed.originUris'] }")
     protected String corsAllowedOrigins;
 
-    @Value("#{ @environment['stormpath.web.cors.allowed.headers'] ?: 'Content-Type,Accept,X-Requested-With,remember-me' }")
+    @Value("#{ @environment['stormpath.web.cors.allowed.headers'] ?: 'Content-Type,Accept,X-Requested-With,remember-me,authorization,x-stormpath-agent' }")
     protected String corsAllowedHeaders;
 
     @Value("#{ @environment['stormpath.web.cors.allowed.methods'] ?: 'POST,GET,OPTIONS,DELETE,PUT' }")
     protected String corsAllowedMethods;
 
+    @Value("#{ @environment['stormpath.web.cors.allow.credentials'] ?: true }")
+    protected boolean corsAllowCredentials;
+
     @Value("#{ @environment['stormpath.web.stormpathFilter.enabled'] ?: true }")
     protected boolean stormpathFilterEnabled;
 
@@ -279,6 +282,7 @@ public CorsConfigurationSource corsConfigurationSource() {
         configuration.setAllowedOrigins(Strings.split(corsAllowedOrigins) != null ? Arrays.asList(Strings.split(corsAllowedOrigins)) : Collections.<String>emptyList());
         configuration.setAllowedHeaders(Strings.split(corsAllowedHeaders) != null ? Arrays.asList(Strings.split(corsAllowedHeaders)) : Collections.<String>emptyList());
         configuration.setAllowedMethods(Strings.split(corsAllowedMethods) != null ? Arrays.asList(Strings.split(corsAllowedMethods)) : Collections.<String>emptyList());
+        configuration.setAllowCredentials(corsAllowCredentials); // fix for https://github.com/stormpath/stormpath-sdk-java/issues/1241
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
         source.registerCorsConfiguration("/**", configuration);
         return source;

extensions/spring/stormpath-spring-security-webmvc/src/main/java/com/stormpath/spring/config/StormpathWebSecurityConfiguration.java

@@ -119,6 +119,7 @@ public AuthenticationEntryPoint stormpathAuthenticationEntryPoint() {
      * @since 1.3.0
      */
     @Bean
+    @Override
     public CorsConfigurationSource corsConfigurationSource() {
         return super.corsConfigurationSource();
     }

extensions/spring/stormpath-spring-webmvc/src/main/java/com/stormpath/spring/config/AbstractStormpathWebMvcConfiguration.java

@@ -406,12 +406,15 @@ public abstract class AbstractStormpathWebMvcConfiguration {
     @Value("#{ @environment['stormpath.web.cors.allowed.originUris'] }")
     protected String corsAllowedOrigins;
 
-    @Value("#{ @environment['stormpath.web.cors.allowed.headers'] ?: 'Content-Type,Accept,X-Requested-With,remember-me' }")
+    @Value("#{ @environment['stormpath.web.cors.allowed.headers'] ?: 'Content-Type,Accept,X-Requested-With,remember-me,authorization,x-stormpath-agent' }")
     protected String corsAllowedHeaders;
 
     @Value("#{ @environment['stormpath.web.cors.allowed.methods'] ?: 'POST,GET,OPTIONS,DELETE,PUT' }")
     protected String corsAllowedMethods;
 
+    @Value("#{ @environment['stormpath.web.cors.allow.credentials'] ?: true }")
+    protected boolean corsAllowCredentials;
+
     @Autowired(required = false)
     protected PathMatcher pathMatcher;
 
@@ -1530,6 +1533,7 @@ public Filter newCorsFilter() {
         config.setAllowedOrigins(stormpathCorsAllowedOrigins());
         config.setAllowedHeaders(stormpathCorsAllowedHeaders());
         config.setAllowedMethods(stormpathCorsAllowedMethods());
+        config.setAllowCredentials(corsAllowCredentials);
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }