From 973826a390d5f583cfacea7be75494ad36bc241f Mon Sep 17 00:00:00 2001 From: Tim Dahlmanns Date: Tue, 23 Jun 2026 12:58:43 +0200 Subject: [PATCH 1/4] refactor: apply cors config to full api --- .../redline/infrastructure/config/SecurityConfig.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java b/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java index 97ad724..964f805 100644 --- a/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java +++ b/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java @@ -76,7 +76,7 @@ CorsConfigurationSource corsConfigurationSource(@Value("${app.cors.allowed-origi config.setAllowedHeaders(List.of("Authorization", "Content-Type", "x-requested-with")); var source = new UrlBasedCorsConfigurationSource(); - source.registerCorsConfiguration("/api/ui/**", config); + source.registerCorsConfiguration("/api/**", config); return source; } From 982e5f5d39f383d5a70a53848ea5199437b5dfc6 Mon Sep 17 00:00:00 2001 From: Tim Dahlmanns Date: Tue, 23 Jun 2026 12:59:05 +0200 Subject: [PATCH 2/4] refactor: cors add methods and headers env config --- .../redline/infrastructure/config/SecurityConfig.java | 11 +++++++---- src/main/resources/application.yml | 4 +++- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java b/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java index 964f805..5b14d6c 100644 --- a/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java +++ b/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java @@ -68,12 +68,15 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti @Bean //@Profile("dev") - CorsConfigurationSource corsConfigurationSource(@Value("${app.cors.allowed-origins}") String allowedOrigins) { + CorsConfigurationSource corsConfigurationSource( + @Value("${app.cors.allowed-origins}") List allowedOrigins, + @Value("${app.cors.allowed-methods:GET,POST,PUT,PATCH,DELETE,OPTIONS}") List allowedMethods, + @Value("${app.cors.allowed-headers:Authorization,Content-Type,x-requested-with}") List allowedHeaders) { var config = new CorsConfiguration(); - config.setAllowedOrigins(List.of(allowedOrigins)); - config.setAllowedMethods(List.of("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")); - config.setAllowedHeaders(List.of("Authorization", "Content-Type", "x-requested-with")); + config.setAllowedOrigins(allowedOrigins); + config.setAllowedMethods(allowedMethods); + config.setAllowedHeaders(allowedHeaders); var source = new UrlBasedCorsConfigurationSource(); source.registerCorsConfiguration("/api/**", config); diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml index 4b3c5c2..b432fbb 100644 --- a/src/main/resources/application.yml +++ b/src/main/resources/application.yml @@ -37,7 +37,9 @@ tenant-manager: app: cors: - allowed-origins: ${CORS_ALLOWED_ORIGIN:http://localhost:4200} + allowed-origins: ${CORS_ALLOWED_ORIGINS:http://localhost:4200} + allowed-methods: ${CORS_ALLOWED_METHODS:GET,POST,PUT,PATCH,DELETE,OPTIONS} + allowed-headers: ${CORS_ALLOWED_HEADERS:Authorization,Content-Type,x-requested-with} --- # Development Profile with H2 From 54de3ab181e7ceab6a7e6678964cdbf62851189e Mon Sep 17 00:00:00 2001 From: Tim Dahlmanns Date: Wed, 24 Jun 2026 09:40:17 +0200 Subject: [PATCH 3/4] delete: duplicated default values --- .../redline/infrastructure/config/SecurityConfig.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java b/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java index 5b14d6c..adf30d8 100644 --- a/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java +++ b/src/main/java/com/metaformsystems/redline/infrastructure/config/SecurityConfig.java @@ -70,8 +70,8 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti //@Profile("dev") CorsConfigurationSource corsConfigurationSource( @Value("${app.cors.allowed-origins}") List allowedOrigins, - @Value("${app.cors.allowed-methods:GET,POST,PUT,PATCH,DELETE,OPTIONS}") List allowedMethods, - @Value("${app.cors.allowed-headers:Authorization,Content-Type,x-requested-with}") List allowedHeaders) { + @Value("${app.cors.allowed-methods}") List allowedMethods, + @Value("${app.cors.allowed-headers}") List allowedHeaders) { var config = new CorsConfiguration(); config.setAllowedOrigins(allowedOrigins); From e8fed92b10b42f919542ea6dd2cbfb8904459e1d Mon Sep 17 00:00:00 2001 From: Tim Dahlmanns Date: Wed, 24 Jun 2026 10:41:31 +0200 Subject: [PATCH 4/4] test: add missing cors config --- src/test/resources/application.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/test/resources/application.yml b/src/test/resources/application.yml index ff72933..5d09d59 100644 --- a/src/test/resources/application.yml +++ b/src/test/resources/application.yml @@ -24,4 +24,6 @@ spring: app: cors: - allowed-origins: "*" \ No newline at end of file + allowed-origins: "*" + allowed-methods: GET,POST,PUT,PATCH,DELETE,OPTIONS + allowed-headers: Authorization,Content-Type,x-requested-with \ No newline at end of file