Implementing cross-origin resource sharing (CORS) in Java RESTful web services

12 Oct 2023

Cross-Origin Resource Sharing (CORS) is a security mechanism that allows web browsers to make requests to a different domain than the one the website is hosted on. This mechanism is essential for building and consuming RESTful web services that are accessed from different domains.

In this blog post, we will explore how to implement CORS in Java RESTful web services using the JAX-RS specification.

What is CORS
Why do we need CORS
Implementing CORS in Java RESTful web services
- 1. Enabling CORS in the server
- 2. Configuring CORS headers
Conclusion

What is CORS

Cross-Origin Resource Sharing (CORS) is a W3C specification that allows web browsers to make cross-origin requests securely. It defines a set of rules that the server must follow to indicate which origins are allowed to access its resources.

Why do we need CORS

By default, web browsers restrict cross-origin requests due to security concerns. Without CORS, a web application hosted on one domain cannot make AJAX requests to a different domain. CORS allows us to relax this restriction and explicitly specify which domains are allowed to access resources from our server.

Implementing CORS in Java RESTful web services

1. Enabling CORS in the server

To enable CORS in a Java RESTful web service, we need to add the cors feature to our server. Most modern Java frameworks, like Jersey or Spring, provide built-in support for enabling CORS.

For example, using Jersey, we can enable CORS by registering the CorsFilter in our application’s configuration class:

import org.glassfish.jersey.server.ResourceConfig;
import org.glassfish.jersey.server.filter.CorsFilter;

public class MyApplication extends ResourceConfig {
    public MyApplication() {
        // Register your RESTful resources
        
        // Enable CORS
        register(CorsFilter.class);
    }
}

2. Configuring CORS headers

Once CORS is enabled in the server, we can configure the CORS headers in our RESTful endpoints using annotations provided by the JAX-RS specification.

import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.Response.ResponseBuilder;
import javax.ws.rs.core.Response.Status;

@Path("/api")
public class MyResource {

    @GET
    @Path("/data")
    @Produces(MediaType.APPLICATION_JSON)
    @CrossOrigin(
        origins = {"http://localhost:3000", "https://example.com"},
        allowHeaders = {"Content-Type", "Authorization"}
    )
    public Response getData() {
        // Retrieve data and return response
        // ...
    }
}

In the example above, we annotate the getData() method with @CrossOrigin and specify the allowed origins and headers. The origins parameter is an array of allowed domain names, and the allowHeaders parameter is an array of allowed headers in the request.

By configuring these annotations, the server will send the appropriate CORS headers back to the client, allowing it to make cross-origin requests.

Conclusion

Implementing Cross-Origin Resource Sharing (CORS) in Java RESTful web services is essential for building secure and accessible APIs. By enabling CORS in the server and configuring the CORS headers, we can ensure that our RESTful endpoints can be accessed from different domains.

By following the steps outlined in this blog post, you can easily implement CORS in your Java RESTful web services and enable communication with various client applications.

Table of Contents