Merge pull request #3 from corona-warn-app/addcors

Addcors

pom.xml

@@ -274,6 +274,10 @@
       <artifactId>nimbus-jose-jwt</artifactId>
       <version>9.9.2</version>
     </dependency>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-security</artifactId>
+    </dependency>
   </dependencies>
 
   <build>

src/main/java/eu/europa/ec/dgc/businessrule/config/CorsConfig.java

@@ -0,0 +1,24 @@
+package eu.europa.ec.dgc.businessrule.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+@Configuration
+@EnableWebSecurity
+public class CorsConfig implements WebMvcConfigurer {
+
+    @Bean
+    CorsConfigurationSource corsConfigurationSource(DgcConfigProperties dgcConfigProperties) {
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        CorsConfiguration corsConfiguration = new CorsConfiguration().applyPermitDefaultValues();
+        corsConfiguration.addAllowedOrigin(dgcConfigProperties.getCorsUrl());
+        source.registerCorsConfiguration("/**",corsConfiguration);
+        return source;
+    }
+
+}

src/main/java/eu/europa/ec/dgc/businessrule/config/DgcConfigProperties.java

@@ -35,6 +35,8 @@ public class DgcConfigProperties {
 
     private final GatewayDownload countryListDownload = new GatewayDownload();
 
+    private String corsUrl;
+
     @Getter
     @Setter
     public static class GatewayDownload {

src/main/java/eu/europa/ec/dgc/businessrule/config/WebSecurityConfig.java

@@ -0,0 +1,15 @@
+package eu.europa.ec.dgc.businessrule.config;
+
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@EnableWebSecurity
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        http.cors();
+    }
+
+}

src/main/resources/application-cloud.yml

@@ -10,6 +10,7 @@ springdoc:
   api-docs:
     enabled: false
 dgc:
+  corsUrl: ${DGC_CORS_ENABLED_URL}
   gateway:
     connector:
       enabled: true

src/main/resources/application.yml

@@ -63,6 +63,7 @@ springdoc:
   swagger-ui:
     path: /swagger
 dgc:
+  corsUrl: https://dgc-gateway.example.com
   businessRulesDownload:
     timeInterval: 1800000
     lockLimit: 3600000

src/test/resources/application.yml

@@ -11,6 +11,7 @@ spring:
   main:
     allow-bean-definition-overriding: true
 dgc:
+  corsUrl: "localhost"
   businessRulesDownload:
     timeInterval: 1800000
     lockLimit: 3600000