(ofbiz-framework) branch release24.09 updated: Improved: Add CORS origins configuration for API security policy

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 5c5f8e90c8 Improved: Add CORS origins configuration for API security policy
5c5f8e90c8 is described below

commit 5c5f8e90c837d47abda368aae901251ac8e12d92
Author: Anahita Goljahani <an...@gmail.com>
AuthorDate: Thu Mar 26 19:58:29 2026 +0100

    Improved: Add CORS origins configuration for API security policy
    
    (cherry picked from commit e44355a8499c058555a764f9d69ef469cd60230b)
---
 .../main/java/org/apache/ofbiz/base/util/UtilMisc.java    | 15 +++++++++++++++
 framework/security/config/security.properties             |  8 ++++++++
 2 files changed, 23 insertions(+)

diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilMisc.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilMisc.java
index 878f222f6c..d7f34ad9e5 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilMisc.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilMisc.java
@@ -616,6 +616,21 @@ public final class UtilMisc {
         return hostHeadersAllowed;
     }
 
+    /**
+     * List of allowed origins for the API CORS policy, read from the
+     * {@code cors.origins.allowed} property in security.properties.
+     * Each entry must be a full origin (scheme + host + optional port),
+     * e.g. {@code https://app.example.com}.
+     * @return unmodifiable list of allowed CORS origins, or null if the property is empty
+     */
+    public static List<String> getCorsOriginsAllowed() {
+        String corsOriginsAllowedString = UtilProperties.getPropertyValue("security", "cors.origins.allowed");
+        if (UtilValidate.isEmpty(corsOriginsAllowedString)) {
+            return null;
+        }
+        return Collections.unmodifiableList(StringUtil.split(corsOriginsAllowedString, ","));
+    }
+
     /**
      * @deprecated use Thread.sleep()
      */
diff --git a/framework/security/config/security.properties b/framework/security/config/security.properties
index 80a765792f..47bea88c9a 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -193,6 +193,14 @@ content.data.url.resource.max.response.size=10485760
 # -- no spaces after commas,no wildcard, can be extended of course...
 host-headers-allowed=localhost,127.0.0.1,demo-trunk.ofbiz.apache.org,demo-stable.ofbiz.apache.org,demo-next.ofbiz.apache.org,demo-trunk.ofbiz-test.apache.org,demo-stable-test.ofbiz.apache.org,demo-next.ofbiz-test.apache.org
 
+# -- Allowed origins for the API CORS policy (Access-Control-Allow-Origin).
+# -- Comma-separated list of origins (scheme + host + optional port), no spaces after commas, no wildcards.
+# -- Only requests whose Origin header exactly matches one of these values will receive
+# -- an Access-Control-Allow-Origin response header echoing that origin.
+# -- Requests from unlisted origins will not receive the header and will be blocked by the browser.
+# -- Example: cors.origins.allowed=https://app.example.com,https://admin.example.com
+cors.origins.allowed=
+
 # -- By default the SameSite value in SameSiteFilter is 'strict'.
 # -- This property allows to change to 'lax' if needed.
 # -- If you use 'lax' we recommend that you set