Spring中的@CrossOrigin注册处理方法源码解析

/**
 * 进行映射注册.
 */
public void register(T mapping, Object handler, Method method) {
    // 首先，获取写入锁.
    this.readWriteLock.writeLock().lock();
    try {
        // 创建HandlerMethod.
        HandlerMethod handlerMethod = createHandlerMethod(handler, method);
        // 验证映射唯一性.
        assertUniqueMethodMapping(handlerMethod, mapping);
        if (logger.isInfoEnabled()) {
            logger.info("Mapped \"" + mapping + "\" onto " + handlerMethod);
        }
        this.mappingLookup.put(mapping, handlerMethod);
        // 搜索直接URL.
        List<String> directUrls = getDirectUrls(mapping);
        for (String url : directUrls) {
            this.urlLookup.add(url, mapping);
        }
        // 解析name，并设置映射名称.
        String name = null;
        if (getNamingStrategy() != null) {
            name = getNamingStrategy().getName(handlerMethod, mapping);
            addMappingName(name, handlerMethod);
        }
        // 初始化CORS配置.
        CorsConfiguration corsConfig = initCorsConfiguration(handler, method, mapping);
        if (corsConfig != null) {
            this.corsLookup.put(handlerMethod, corsConfig);
        }
        this.registry.put(mapping, new MappingRegistration<>(mapping, handlerMethod, directUrls, name));
    }
    finally {
        // 释放写入锁.
        this.readWriteLock.writeLock().unlock();
    }
}

/**
 * 初始化CORS配置.
 */
@Override
protected CorsConfiguration initCorsConfiguration(Object handler, Method method, RequestMappingInfo mappingInfo) {
    // 创建HandlerMethod.
    HandlerMethod handlerMethod = createHandlerMethod(handler, method);
    // 获取方法所属类型.
    Class<?> beanType = handlerMethod.getBeanType();
    // 查找类级别注释.
    CrossOrigin typeAnnotation = AnnotatedElementUtils.findMergedAnnotation(beanType, CrossOrigin.class);
    // 查找方法级别注释.
    CrossOrigin methodAnnotation = AnnotatedElementUtils.findMergedAnnotation(method, CrossOrigin.class);
    // 类和方法级别无注释，跳过处理.
    if (typeAnnotation == null && methodAnnotation == null) {
        return null;
    }
    // 初始化配置.
    CorsConfiguration config = new CorsConfiguration();
    // 更新类级别@CrossOrigin注解配置.
    updateCorsConfig(config, typeAnnotation);
    // 更新方法级别@CrossOrigin注解配置.    
    updateCorsConfig(config, methodAnnotation);
    // 若@CrossOrigin未标准HTTP方法，则以@RequestMapping标准HTTP方法为准.
    if (CollectionUtils.isEmpty(config.getAllowedMethods())) {
        for (RequestMethod allowedMethod : mappingInfo.getMethodsCondition().getMethods()) {
            config.addAllowedMethod(allowedMethod.name());
        }
    }
    // 为未初始化的配置设置默认值.
    return config.applyPermitDefaultValues();
}

/**
 * 更新CORS配置.
 */
private void updateCorsConfig(CorsConfiguration config, @Nullable CrossOrigin annotation) {
    // 注解为空，跳过处理.
    if (annotation == null) {
        return;
    }
    // 解析@CrossOrigin.origins属性到配置.
    for (String origin : annotation.origins()) {
        config.addAllowedOrigin(resolveCorsAnnotationValue(origin));
    }
    // 解析@CrossOrigin.methods属性到配置.
    for (RequestMethod method : annotation.methods()) {
        config.addAllowedMethod(method.name());
    }
    // 解析@CrossOrigin.allowedHeaders属性到配置.
    for (String header : annotation.allowedHeaders()) {
        config.addAllowedHeader(resolveCorsAnnotationValue(header));
    }
    // 解析@CrossOrigin.exposedHeaders属性到配置.
    for (String header : annotation.exposedHeaders()) {
        config.addExposedHeader(resolveCorsAnnotationValue(header));
    }
    // 解析@CrossOrigin.allowCredentials属性到配置.
    String allowCredentials = resolveCorsAnnotationValue(annotation.allowCredentials());
    if ("true".equalsIgnoreCase(allowCredentials)) {
        config.setAllowCredentials(true);
    }
    else if ("false".equalsIgnoreCase(allowCredentials)) {
        config.setAllowCredentials(false);
    }
    else if (!allowCredentials.isEmpty()) {
        throw new IllegalStateException("@CrossOrigin's allowCredentials value must be \"true\", \"false\", " +
                                        "or an empty string (\"\"): current value is [" + allowCredentials + "]");
    }
    // 解析@CrossOrigin.maxAge属性到配置.
    if (annotation.maxAge() >= 0 && config.getMaxAge() == null) {
        config.setMaxAge(annotation.maxAge());
    }
}

/**
 * 默认情况下，新建的CorsConfiguration不允许任何跨源请求，必须填加相应配置以允许请求.
 * 
 * 使用这个方法为未初始化的配置打开默认的跨域设置，包括：GET、HEAD、POST.
 * 但是请注意，此方法不会覆盖任何已设置的现有值.
 *
 * 如果尚未设置，则应用以下默认值:
 *	允许所有源.
 *	允许简单HTTP方法：GET、HEAD、POST.
 *  允许所有HTTP头.
 *  设置最大使用时间1800秒（30分钟）.
 */
public CorsConfiguration applyPermitDefaultValues() {
    // 若未设置允许源，则设置所有源均允许.
    if (this.allowedOrigins == null) {
        this.allowedOrigins = DEFAULT_PERMIT_ALL;
    }
    // 若未设置允许方法，则设置允许GET、HEAD、POST.
    if (this.allowedMethods == null) {
        this.allowedMethods = DEFAULT_PERMIT_METHODS;
        this.resolvedMethods = DEFAULT_PERMIT_METHODS
            .stream().map(HttpMethod::resolve).collect(Collectors.toList());
    }
    // 若未设置允许头，则设置所有头均允许.
    if (this.allowedHeaders == null) {
        this.allowedHeaders = DEFAULT_PERMIT_ALL;
    }
    // 若未设置最大使用时间，则设置为1800秒（30分钟）.
    if (this.maxAge == null) {
        this.maxAge = 1800L;
    }
    return this;
}