CORS Deep Dive
CORS, EK BROWSER SECURITY MECHANISM hai — SAME-ORIGIN POLICY ke, KAARAN, EK WEBSITE (jaise app.example.com) ke JAVASCRIPT SE, EK DIFFERENT ORIGIN (jaise api.different.com) ki API, DIRECTLY, CALL NAHI ki ja sakti, JAB TAK, SERVER, EXPLICITLY, CORS HEADERS SE, PERMISSION NA DE.
SPRING BOOT mein, CORS, @CrossOrigin ANNOTATION (SPECIFIC CONTROLLER/METHOD PAR), YA GLOBAL CorsConfigurationSource BEAN (POORI APPLICATION ke liye), SE, CONFIGURE ki jaati hai — ALLOWED ORIGINS, METHODS, HEADERS, EXPLICITLY, SPECIFY kiye jaate hain.
// Global CORS config — SAARE endpoints ke liye:
@Configuration
public class CorsConfig {
@Bean
public WebMvcConfigurer corsConfigurer() {
return new WebMvcConfigurer() {
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/api/**")
.allowedOrigins("https://app.example.com")
.allowedMethods("GET", "POST", "PUT", "DELETE")
.allowedHeaders("*")
.allowCredentials(true);
}
};
}
}
// Controller-specific:
@CrossOrigin(origins = "https://app.example.com")
@RestController
public class ProductController { }- CORS = browser security mechanism, cross-origin JavaScript requests control karta hai
- Server, EXPLICITLY, allowed origins/methods/headers, specify karta hai
- Production mein, allowedOrigins("*") + allowCredentials(true), KABHI SAATH mat use karo
COMPLEX, CORS REQUESTS (jaise, CUSTOM, HEADERS ke SAATH, YA, PUT/DELETE, METHODS), Browser, PEHLE, EK, "PREFLIGHT" (OPTIONS METHOD) REQUEST, BHEJTA hai, SERVER SE, PERMISSION, CONFIRM karne ke liye, ACTUAL, REQUEST, BHEJNE SE, PEHLE.
AGAR, TUM, COOKIES (jaise, SESSION-BASED, AUTH) USE kar rahe ho, CROSS-ORIGIN, REQUESTS mein, allowCredentials(true), SERVER-SIDE, aur, CLIENT-SIDE, DONO PAR (fetch SE, credentials: 'include'), SET karna, ZAROORI hai — WARNA, COOKIES, REQUEST ke, SAATH, NAHI, JAAYENGI.
// Client-side (fetch):
fetch('https://api.example.com/data', { credentials: 'include' });