This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro.git
commit 2e3ffaf6c8491cc07ae09d4667dbdd1913009cfa Author: lprimak <[email protected]> AuthorDate: Wed Oct 21 21:26:37 2026 -0500 javadoc: add documentation for CORS preflight requests in HttpAuthenticationFilter --- .../shiro/web/filter/authc/HttpAuthenticationFilter.java | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java index 3779f763b..1a89be8e5 100644 --- a/web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java +++ b/web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java @@ -166,6 +166,22 @@ abstract class HttpAuthenticationFilter extends AuthenticatingFilter { this.authcScheme = authcScheme; } + /** + * Sets whether CORS preflight requests are allowed through this filter without authentication. Defaults to + * {@code true}. + * <p> + * A request is treated as a preflight if it is an {@code OPTIONS} request with non-empty {@code Origin} and + * {@code Access-Control-Request-Method} headers. Both are supplied by the client, so any client, not only a + * browser, can send a request that is treated as a preflight. Such requests are <em>not</em> answered by this + * filter; they continue down the filter chain to the application, <b>unauthenticated</b>, including to + * any {@code OPTIONS} handler, or to any handler that also accepts {@code OPTIONS} + * (for example, a framework mapping without a restricted HTTP method). + * <p> + * If such handlers must be protected, annotate them with the appropriate Shiro authorization annotations, + * or set this property to {@code false} and place a dedicated CORS filter in front of this one. + * + * @param allowPreFlightRequests {@code true} to let preflight requests bypass authentication + */ public void setAllowPreFlightRequests(boolean allowPreFlightRequests) { this.allowPreFlightRequests = allowPreFlightRequests; }
