Sets up CORS for the service.

Author: ignasi35

cors/cors-java/README.md

@@ -1,9 +1,36 @@
 # CORS recipe for Lagom's Javadsl
 
+In order to enable CORS on a Lagom service the following steps are required:
+
+1. include `filters` as a dependency on your `-impl` project. `filters` is a package provided by Play Framework.
+2. Create a class that implements `DefaultHttpFilters` and inject Play's `CORSFilter`
+3. Register that newly created class on your `application.conf` using: `play.http.filters = "com.your.package.YourFilterClassName"`
+4. Finally, add an ACL on your `Service.Descriptor` matching the `OPTIONS` method for the paths you are exposing on your Service Gateway.
+
+## Testing the recipe
+
+
+You can test this recipe using 2 separate terminals.
+
+On one terminal start the service:
+
+```
+sbt runAll
+```
+
+On a separate terminal, use `curl` to trigger a pre-flight request:
 
 ```
 curl -H "Access-Control-Request-Method: GET" \
         -H "Access-Control-Request-Headers: origin, x-requested-with" \
         -H "Origin: http://www.some-domain.com"  \
         -X OPTIONS http://localhost:9000/api/hello/123 -v        
 ```
+
+Note how the request uses the `OPTIONS` method and targets the [Lagom Service Gateway](https://www.lagomframework.com/documentation/1.3.x/java/ServiceLocator.html) (`localhost:9000`).
+
+## More resources
+
+This topic has been discussed in the Lagom Mailing List [a](https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/lagom-framework/_3Hjvp18NNU/ygu8Pa5wAQAJ) [few](https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/lagom-framework/7YZccqRUS4g/HNMykAiGBAAJ) [times](https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/lagom-framework/3y0wgIMillE/ItT1rPDfBgAJ), if this recipe doesn't resolve your doubts, feel free to ask for help in the community.
+
+You will also find the [Play Framework documentation](https://playframework.com/documentation/2.5.x/CorsFilter) on the topic quite useful. 

cors/cors-java/build.sbt

@@ -18,6 +18,7 @@ lazy val `cors-java-impl` = (project in file("cors-java-impl"))
   .enablePlugins(LagomJava)
   .settings(
     libraryDependencies ++= Seq(
+      filters
     )
   )
   .dependsOn(`cors-java-api`)

cors/cors-java/cors-java-api/src/main/java/com/lightbend/lagom/recipes/corsjava/api/CorsjavaService.java

@@ -6,7 +6,9 @@
 import akka.NotUsed;
 import com.lightbend.lagom.javadsl.api.Descriptor;
 import com.lightbend.lagom.javadsl.api.Service;
+import com.lightbend.lagom.javadsl.api.ServiceAcl;
 import com.lightbend.lagom.javadsl.api.ServiceCall;
+import com.lightbend.lagom.javadsl.api.transport.Method;
 
 import static com.lightbend.lagom.javadsl.api.Service.named;
 import static com.lightbend.lagom.javadsl.api.Service.pathCall;
@@ -22,7 +24,11 @@ public interface CorsjavaService extends Service {
     default Descriptor descriptor() {
         return named("corsjava").withCalls(
             pathCall("/api/hello/:id", this::hello)
-        ).withAutoAcl(true);
+        ).withAutoAcl(
+            true
+        ).withServiceAcls(
+            ServiceAcl.methodAndPath(Method.OPTIONS, "/api/hello/.*")
+        );
     }
 
 }

cors/cors-java/cors-java-impl/src/main/java/com/lightbend/lagom/recipes/corsjava/impl/MyCORSFilter.java

@@ -0,0 +1,14 @@
+package com.lightbend.lagom.recipes.corsjava.impl;
+
+import play.filters.cors.CORSFilter;
+import play.http.DefaultHttpFilters;
+
+import javax.inject.Inject;
+
+// See https://playframework.com/documentation/2.5.x/CorsFilter
+public class MyCORSFilter extends DefaultHttpFilters {
+    @Inject
+    public MyCORSFilter(CORSFilter corsFilter) {
+        super(corsFilter);
+    }
+}

cors/cors-java/cors-java-impl/src/main/resources/application.conf

@@ -4,3 +4,18 @@
 play.crypto.secret=whatever
 play.modules.enabled += com.lightbend.lagom.recipes.corsjava.impl.CorsjavaModule
 
+play.http.filters = "com.lightbend.lagom.recipes.corsjava.impl.MyCORSFilter"
+
+// To properly setup the CORSFilter, please refer to https://playframework.com/documentation/2.5.x/CorsFilter
+// This example is only meant to show what's required for Lagom to use CORS.
+play.filters.cors {
+  // review the values of all these settings to fulfill your needs. These values are not meant for production.
+  pathPrefixes = ["/api"]
+  allowedOrigins = null
+  allowedHttpMethods = null
+  allowedHttpHeaders = null
+  exposedHeaders = []
+  supportsCredentials = false
+  preflightMaxAge = 6 hour
+}
+