true if CORS request; false
- * otherwise.simple or preflight or not_cors or
- * invalid_corsnull if elements
- * {@link Set} is null.
- */
- public static String join(final Collectiontrue if origin is allowed; false
- * otherwise.
- */
- private boolean isOriginAllowed(final String origin) {
- if (anyOriginAllowed) {
- return true;
- }
-
- // If 'Origin' header is a case-sensitive match of any of allowed
- // origins, then return true, else return false.
- return allowedOrigins.contains(origin);
- }
-
- private void log(String message) {
- if (loggingEnabled) {
- filterConfig.getServletContext().log(message);
- }
- }
-
- /**
- * Parses each param-value and populates configuration variables. If a param
- * is provided, it overrides the default.
- *
- * @param allowedOrigins
- * A {@link String} of comma separated origins.
- * @param allowedHttpMethods
- * A {@link String} of comma separated HTTP methods.
- * @param allowedHttpHeaders
- * A {@link String} of comma separated HTTP headers.
- * @param exposedHeaders
- * A {@link String} of comma separated headers that needs to be
- * exposed.
- * @param supportsCredentials
- * "true" if support credentials needs to be enabled.
- * @param preflightMaxAge
- * The amount of seconds the user agent is allowed to cache the
- * result of the pre-flight request.
- * @param loggingEnabled
- * Flag to control logging to access log.
- * @throws ServletException
- */
- private void parseAndStore(final String allowedOrigins,
- final String allowedHttpMethods, final String allowedHttpHeaders,
- final String exposedHeaders, final String supportsCredentials,
- final String preflightMaxAge, final String loggingEnabled,
- final String decorateRequest)
- throws ServletException {
- if (allowedOrigins != null) {
- if (allowedOrigins.trim().equals("*")) {
- this.anyOriginAllowed = true;
- } else {
- this.anyOriginAllowed = false;
- Settrue if it's enabled; false otherwise.
- */
- public boolean isLoggingEnabled() {
- return loggingEnabled;
- }
-
- /**
- * Determines if any origin is allowed to make CORS request.
- *
- * @return true if it's enabled; false otherwise.
- */
- public boolean isAnyOriginAllowed() {
- return anyOriginAllowed;
- }
-
- /**
- * Returns a {@link Set} of headers that should be exposed by browser.
- *
- * @return
- */
- public Collection- If you are intending to support JavaScript clients in your server application, - you will need to enable Cross Origin Resource Sharing (CORS). There are - a number of ways of supporting this, but the easiest is to use a servlet filter. -
- -+
Note that in previous revisions of this document we recommended using the eBay CORS Filter, but as of 2016 the eBay filter is no longer being maintained and contains known bugs. @@ -24,35 +18,80 @@
- The following examples show how to use the Apache Tomcat CorsFilter to enable - CORS support. The instructions below should work even on platforms other than - Tomcat (in other words, you can deploy the Tomcat CorsFilter to Jetty or JBoss if you like) - but if you run into conflicts it may be worth investigating if there is a dedicated - CORS filter for the platform you are using. + If you are intending to support JavaScript clients in your server application, + you will generally need to enable Cross Origin Resource Sharing (CORS). There are + a number of ways of supporting this, so two are shown here:
+- If you are deploying to a platform other than Tomcat, add the - following dependency to your Maven POM. If you are deploying - to Tomcat, the required classes are present on the classpath - so youdo not need to do this step. + The HAPI FHIR server framework includes an interceptor that can be + used to provide CORS functionality on your server. This mechanism is + nice because it relies purely on Java configuration (no messing around with + web.xml files). HAPI's interceptor is a thin wrapper around Spring Framework's + CorsProcessor class, so it requires Spring to be present on your classpath.
- +- Add the following dependency to your POM: + Spring is generally unlikely to conflict with other libraries so it is usually + safe to add it to your classpath, but it is a fairly large library so if size is + a concern you might opt to use a filter instead. +
+ ++ The following steps outline how to enable HAPI's CorsInterceptor: +
+ ++ Add the following dependency to your POM. Note the exclusion of + commons-logging, as we are using SLF4j without commons-logging in + most of our examples. If your application uses commons-logging you don't need + to exclude that dependency.
+ In your server's initialization method, create and register + a CorsInterceptor: +
+
+ The following examples show how to use the Apache Tomcat CorsFilter to enable
+ CORS support. The filter being used
+ (org.apache.catalina.filters.CorsFilter) is bundled with Apache
+ Tomcat so if you are deploying to that server you can use the filter.
+
+ Other containers have similar filters you can use, so consult the documentation + for the given container you are using for more information. (If you have + an example for how to configure a different CORS filter, please send it + our way! Examples are always useful!) +
+In your web.xml file (within the WEB-INF directory in your WAR file), the following filter definition adds the CORS filter, including support diff --git a/src/site/xdoc/doc_rest_server_interceptor.xml b/src/site/xdoc/doc_rest_server_interceptor.xml index 5f3e37a7627..24ed03d5402 100644 --- a/src/site/xdoc/doc_rest_server_interceptor.xml +++ b/src/site/xdoc/doc_rest_server_interceptor.xml @@ -290,6 +290,17 @@
+ HAPI FHIR includes an interceptor which can be used to + implement CORS support on your server. See HAPI's + CORS Documentation for information + on how to use this interceptor. +
+ +