Configuring CORS in Java

Introduction

Welcome to the second lesson of the "Web Resource Integrity and Secure Configuration in Java Web Applications" course! In this lesson, we'll explore Cross-Origin Resource Sharing (CORS), a crucial aspect of web security. CORS is a mechanism that allows or restricts resources on a web page to be requested from another domain. Properly configuring CORS is essential to prevent unauthorized access to your web applications. In this lesson, we will focus on how to understand and securely configure CORS in Java web frameworks such as Spring Boot . 🌐

Understanding CORS and Its Security Implications

Previously, we covered how to detect data integrity failures through SRI and discussed how to avoid them by understanding their roots in improper resource verification. This included hash generation, integrity attribute implementation, and automated SRI injection as ways to prevent unauthorized resource modifications. However, even with robust resource integrity controls in place, data integrity can still be compromised through cross-origin attacks. For example, if a user is authenticated to your banking application, a malicious site they visit at the same time could make requests to your API and potentially modify or extract sensitive data by leveraging the user's authenticated session. This is where CORS becomes essential. While SRI mechanisms verify resource integrity, CORS controls which external origins are permitted to interact with your application in the first place, addressing a critical vector for potential data integrity breaches. CORS is a security feature implemented by web browsers to control how resources are shared between different origins. An "origin" is defined by the combination of a URL's protocol, domain, and port. Without CORS, a web application could freely request resources from any domain, which could lead to security vulnerabilities. Improper CORS configuration can expose sensitive data to unauthorized domains, making it crucial to understand and implement CORS correctly. Understanding CORS Enforcement: CORS headers (like Access-Control-Allow-Origin) are instructions to browsers on how to handle cross-origin requests. The browser enforces these policies—if a server returns permissive CORS headers, the browser will allow the cross-origin request. However, server-side Origin validation (checking the Origin header in your application code) provides defense-in-depth for API-to-API calls and can block requests before they reach your application logic, even if a browser isn't involved.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Step 3: Enable and Configure CORS

To enable and configure CORS in Spring Boot, create a configuration class that implements WebMvcConfigurer. This class will define which origins, methods, and headers are allowed.

Java

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        String[] origins = {
            "https://trusted-domain.com",
            "https://another-trusted.com",
            "http://localhost",
            "http://127.0.0.1:3000"
        };
        
        registry.addMapping("/api/**")
            .allowedOrigins(origins)
            .allowedMethods("GET", "POST")
            .allowedHeaders("Content-Type", "Authorization")
            .allowCredentials(true);
    }
}

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        String[] origins = {
            "https://trusted-domain.com",
            "https://another-trusted.com",
            "http://localhost",
            "http://127.0.0.1:3000"
        };
        
        registry.addMapping("/api/**")
            .allowedOrigins(origins)
            .allowedMethods("GET", "POST")
            .allowedHeaders("Content-Type", "Authorization")
            .allowCredentials(true);
    }
}

In this configuration:

addMapping("/api/**") specifies which endpoints the CORS settings apply to.
.allowedOrigins(origins) restricts access to the trusted domains specified in the array.
.allowedMethods("GET", "POST") limits the allowed HTTP methods.
.allowedHeaders("Content-Type", "Authorization") specifies which headers are permitted.
.allowCredentials(true) allows cookies and credentials to be sent with requests.

By configuring CORS in this way, you ensure that only requests from trusted origins are allowed, with specific methods and headers permitted.

Introduction

Understanding CORS and Its Security Implications

Join the 1M+ learners on CodeSignal

Understanding CORS Preflight Requests

Exploiting Improper CORS Configuration

Defensive Example: Configuring CORS in Java (Spring Boot)

Step 1: Initiate CORS Configuration

Step 2: Define Allowed Origins

Step 3: Enable and Configure CORS

Best Practices for Secure CORS Configuration

Conclusion and Next Steps