Refactor CORS handling into injectable components by sdelamo · Pull Request #12982 · micronaut-projects/micronaut-core

sdelamo · 2026-09-03T08:59:45Z

Extract origin configuration lookup, response decoration, and preflight validation from CorsFilter into dedicated components.

Add a configuration option to disable the CORS filter entirely, preserve deprecated extension points for compatibility, and expand coverage for CORS utilities, preflight validation, and filter configuration.

Related to: micronaut-projects/micronaut-security#2271

Extract origin configuration lookup, response decoration, and preflight validation from CorsFilter into dedicated components. Add a configuration option to disable the CORS filter entirely, preserve deprecated extension points for compatibility, and expand coverage for CORS utilities, preflight validation, and filter configuration.

Copilot

🟡 Changes recommended

There are correctness issues (including a route-builder call in a new test that should not compile) and several newly introduced @since tags that don’t match the branch version.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request refactors Micronaut HTTP server CORS handling by extracting CorsFilter responsibilities into injectable strategy components, while adding configuration to disable the filter entirely and expanding test coverage around the new CORS utilities and preflight validation.

Changes:

Introduces injectable strategy APIs and default implementations for origin configuration retrieval, preflight validation, and response decoration.
Adds micronaut.server.cors.filter.enabled configuration (default enabled) to disable the CORS filter bean entirely.
Adds/expands tests for CrossOriginUtil, preflight validation behavior, and filter enablement configuration.

File summaries

File	Description
http-server/src/test/java/io/micronaut/http/server/cors/PreflightRequestValidatorTest.java	New unit test coverage for preflight validator behavior against routes/headers/private-network.
http-server/src/test/java/io/micronaut/http/server/cors/CrossOriginUtilTest.java	New unit tests for `CrossOriginUtil` matching and annotation-to-config conversion.
http-server/src/test/groovy/io/micronaut/http/server/HttpServerConfigurationSpec.groovy	Adds assertions for default-enabled and configurable disabling of the CORS filter bean.
http-server/src/main/java/io/micronaut/http/server/HttpServerConfiguration.java	Adds nested `cors.filter` configuration model to control filter enablement.
http-server/src/main/java/io/micronaut/http/server/cors/PreflightRequestValidator.java	New strategy interface for validating preflight requests.
http-server/src/main/java/io/micronaut/http/server/cors/DefaultPreflightRequestValidator.java	Default implementation performing method/header/private-network checks and route/static-resource validation.
http-server/src/main/java/io/micronaut/http/server/cors/DefaultCorsResponseDecorator.java	Default implementation responsible for writing CORS response headers.
http-server/src/main/java/io/micronaut/http/server/cors/DefaultCorsOriginConfigurationRetriever.java	Default implementation resolving route-level CORS config first, then server-level config.
http-server/src/main/java/io/micronaut/http/server/cors/CrossOriginUtil.java	Expands shared CORS utility/matching/conversion logic for reuse across the new components.
http-server/src/main/java/io/micronaut/http/server/cors/CorsResponseDecorator.java	New strategy interface for CORS response header decoration.
http-server/src/main/java/io/micronaut/http/server/cors/CorsOriginConfigurationRetriever.java	New strategy interface for resolving the applicable origin configuration from origin + route matches.
http-server/src/main/java/io/micronaut/http/server/cors/CorsOriginConfiguration.java	Javadoc enhancements for existing CORS origin configuration accessors.
http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java	Refactors filter to delegate to injected strategy components and adds `@Requires` gating via configuration.

Review details

Suppressed comments (3)

http-server/src/main/java/io/micronaut/http/server/HttpServerConfiguration.java:927

setFilter is marked @since 5.4.0, but this branch’s projectVersion is 5.2.0-SNAPSHOT and the setter is introduced here; please align the @since tag with the branch debut version.

         * @since 5.4.0

http-server/src/main/java/io/micronaut/http/server/HttpServerConfiguration.java:1050

The new CorsFilterConfiguration nested type is marked @since 5.4.0, but this branch is 5.2.0-SNAPSHOT and the type is introduced in this PR. Update the @since tag to match the actual debut version.

         * @since 5.4.0

http-server/src/main/java/io/micronaut/http/server/cors/CrossOriginUtil.java:224

getCorsOriginConfigurationForAnnotationMetadataProvider is introduced here but is marked @since 5.4.0. On this 5.2.0-SNAPSHOT branch, the @since tag should be 5.2.0.

     * @since 5.4.0

Files reviewed: 13/13 changed files
Comments generated: 4
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+        }
+
+        void addRoute(TestController controller) {
+            GET(ROUTE, controller);


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Replace this usage of 'Stream.collect(Collectors.toList())' with 'Stream.toList()' and ensure that the list is unmodified.

Throw UnsupportedOperationException from the deprecated CorsFilter header mutation methods because CORS response headers are now populated by CorsResponseDecorator. > Add a nested comment explaining why this method is empty, throw an UnsupportedOperationException or complete the implementation.

Set Access-Control-Request-Private-Network to "true" instead of the requested HTTP method when building CORS preflight requests.

dstepanov

Reviewed the extraction against the original CorsFilter logic method by method — DefaultCorsOriginConfigurationRetriever, DefaultPreflightRequestValidator and DefaultCorsResponseDecorator reproduce the previous behaviour faithfully, including the route-level → server-wide fall-through and the !corsConfiguration.isEnabled() short-circuit. The two deliberate behaviour changes both look like fixes: (AnnotationMetadata) rm → rm.getAnnotationMetadata(), and gating Access-Control-Allow-Private-Network on .filter(Boolean.TRUE::equals) rather than header presence — which is what makes the TCK change meaningful, since that assertion was previously vacuous.

Three things worth a look, inline. Two non-blocking notes as well:

The new public SPIs (CorsResponseDecorator, PreflightRequestValidator, CorsOriginConfigurationRetriever) point @DefaultImplementation at package-private @Internal classes, so a consumer can replace them but cannot subclass or delegate to the defaults — the protected methods on DefaultCorsResponseDecorator are unreachable from outside the package.
micronaut.server.cors.filter.enabled gets no entry in src/main/docs/guide/httpServer/serverConfiguration/cors.adoc, which is where the distinction from cors.enabled most needs explaining.

graemerocher · 2026-09-04T06:07:46Z

I agree this is a breaking change and can't go into a minor release

Route default CORS response decoration through the deprecated protected mutators so existing CorsFilter subclasses can continue customizing headers, while preserving custom CorsResponseDecorator behavior. Delegate the default mutators to DefaultCorsResponseDecorator, handle filters without a router, and add coverage for standard and short-circuited preflight responses.

sdelamo · 2026-09-04T10:25:08Z

@graemerocher the PR should not longer be a breaking change.

graemerocher · 2026-09-04T10:28:14Z

+         *
+         * @since 5.2.0
+         */
+        @ConfigurationProperties("filter")


why is the namespace here just "filter" and not "cors-filter"?

graemerocher · 2026-09-04T10:30:05Z

+            return null;
+        }
+        for (RouteMatch<?> routeMatch : routeMatches) {
+            Optional<CorsOriginConfiguration> originConfigurationOptional =


optional adds overhead and this looks like some kind of internal API call so seems unnecessary

resolved via 376917d

graemerocher · 2026-09-04T10:31:16Z

 * @author Sergio del Amo
 * @since 3.9.0
 */
 public final class CrossOriginUtil {


review this class and see what needs to be internal / non-public

adding lots of what seem to be internal focused methods to the public API surface doesn't seem wise

sonarqubecloud · 2026-09-10T16:59:46Z

Quality Gate passed

Issues
22 New issues
0 Accepted issues

Measures
0 Security Hotspots
86.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sdelamo requested review from dstepanov and a lite review from Copilot September 3, 2026 08:59

Copilot started reviewing on behalf of sdelamo September 3, 2026 09:01 View session

sdelamo added the type: improvement A minor improvement to an existing feature label Sep 3, 2026

sdelamo added this to 5.2.0 Release Sep 3, 2026

github-project-automation Bot moved this to Backlog in 5.2.0 Release Sep 3, 2026

Copilot AI reviewed Sep 3, 2026

View reviewed changes

sdelamo and others added 3 commits September 3, 2026 11:14

Update CORS method version annotation from 5.4.0 to 5.2.0

6127259

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Update CORS filter configuration version in comments

35c0c69

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Refactor private network header handling in CORS

ef3f00c

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

sdelamo requested a review from graemerocher September 3, 2026 10:14

sdelamo added 3 commits September 3, 2026 12:16

Use Stream.toList()

35fd9fb

Replace this usage of 'Stream.collect(Collectors.toList())' with 'Stream.toList()' and ensure that the list is unmodified.

Fix private network CORS request header

26e4274

Set Access-Control-Request-Private-Network to "true" instead of the requested HTTP method when building CORS preflight requests.

dstepanov reviewed Sep 3, 2026

View reviewed changes

Comment thread http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java

Comment thread http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java

Comment thread http-server/src/main/java/io/micronaut/http/server/HttpServerConfiguration.java Outdated

sdelamo added 2 commits September 4, 2026 10:14

correct since

1f3bf32

sdelamo mentioned this pull request Sep 4, 2026

Add extensible response header populators #12992

Merged

graemerocher requested changes Sep 4, 2026

View reviewed changes

sdelamo added 8 commits September 10, 2026 12:04

Merge branch '5.2.x' into extract-cors-apis-52x

b8d2ef4

fix merge

dc91575

remove merge test

abdfebf

Make default CORS components final

955ed47

don’t use optionals

376917d

make it package private

9f36cc6

fix checkstyle

c4dc07e

remove unnecessary checks

781aa40

sdelamo added 2 commits September 10, 2026 15:01

make it package private

48a73d5

Restrict CrossOriginUtil internal API visibility

8af25ff

sdelamo changed the base branch from 5.2.x to 5.3.x September 10, 2026 13:45

add docs

d71c402

Uh oh!

Conversation

sdelamo commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (3)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dstepanov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

graemerocher commented Sep 4, 2026

Uh oh!

sdelamo commented Sep 4, 2026

Uh oh!

Uh oh!

Uh oh!

graemerocher Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

graemerocher Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

sdelamo Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

graemerocher Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Sep 10, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sdelamo commented Sep 3, 2026 •

edited

Loading