Hi! I'm trying to replace spring security config w...

# spring

[Ivan Pavlov]

Hi!
I'm trying to replace spring security config with new dsl:

http.cors().configurationSource { CorsConfiguration().applyPermitDefaultValues() }

However MVC dsl for CORS doesn't contain an ability to set configuration source (CorsDsl). I can see that in WebFlux version (ServerCorsDsl) there is

var configurationSource: CorsConfigurationSource? = null

Does anyone know why there is no such property for MVC?

[Joris PZ]

That works for me just fine, using Spring Security 5.4.1 and Spring Boot 2.4.0

[Joris PZ]

Alternatively, you can add a configuration bean in the context as follows and it will be picked up automatically:

@Bean
fun corsConfigurationSource(): CorsConfigurationSource {
   //
}

[Ivan Pavlov]

I'm extending WebSecurityConfigurerAdapter() and using spring-security-config 5.4.1. Are you using it the same way?

[Joris PZ]

Yeah, pretty much. This is the essence of my code (although in reality I use the variant with an explicit @Bean that exposes a CorsConfigurationSource, but this compiles for me)

@Configuration
class APISecurityConfig() : WebSecurityConfigurerAdapter() {

  override fun configure(http: HttpSecurity) {
        http
            .antMatcher("/api/**")
            .cors().configurationSource { CorsConfiguration().applyPermitDefaultValues() }.and()

       // ETC
}

[Ivan Pavlov]

But this is not a dsl, I'm trying to replace this configuration:

http.cors().configurationSource { CorsConfiguration().applyPermitDefaultValues() }

with dsl:

http {
  cors {
    //set configuration source here
  }
}

Sorry if my original question was written badly 🙂

[Joris PZ]

Ah, right! Yeah, then you're on your own 🙂