Merge branch '4.0.x'

Closes gh-50394

Author: bclozel

module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfiguration.java

@@ -180,9 +180,17 @@ static class WebSocketConfiguration {
 		@Bean
 		@ConditionalOnMissingBean
 		GraphQlWebSocketHandler graphQlWebSocketHandler(WebGraphQlHandler webGraphQlHandler,
-				GraphQlProperties properties, ServerCodecConfigurer configurer) {
-			return new GraphQlWebSocketHandler(webGraphQlHandler, configurer,
-					properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive());
+				GraphQlProperties properties, GraphQlCorsProperties corsProperties, ServerCodecConfigurer configurer) {
+			CorsConfiguration corsConfiguration = corsProperties.toCorsConfiguration();
+			if (corsConfiguration != null) {
+				return new GraphQlWebSocketHandler(webGraphQlHandler, configurer,
+						properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive(),
+						corsConfiguration);
+			}
+			else {
+				return new GraphQlWebSocketHandler(webGraphQlHandler, configurer,
+						properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive());
+			}
 		}
 
 		@Bean

module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfiguration.java

@@ -186,9 +186,18 @@ static class WebSocketConfiguration {
 		@Bean
 		@ConditionalOnMissingBean
 		GraphQlWebSocketHandler graphQlWebSocketHandler(WebGraphQlHandler webGraphQlHandler,
-				GraphQlProperties properties, ObjectProvider<ServerHttpMessageConvertersCustomizer> customizers) {
-			return new GraphQlWebSocketHandler(webGraphQlHandler, getJsonConverter(customizers),
-					properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive());
+				GraphQlProperties properties, GraphQlCorsProperties corsProperties,
+				ObjectProvider<ServerHttpMessageConvertersCustomizer> customizers) {
+			CorsConfiguration corsConfiguration = corsProperties.toCorsConfiguration();
+			if (corsConfiguration != null) {
+				return new GraphQlWebSocketHandler(webGraphQlHandler, getJsonConverter(customizers),
+						properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive(),
+						corsConfiguration);
+			}
+			else {
+				return new GraphQlWebSocketHandler(webGraphQlHandler, getJsonConverter(customizers),
+						properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive());
+			}
 		}
 
 		private HttpMessageConverter<Object> getJsonConverter(

module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfigurationTests.java

@@ -22,6 +22,7 @@
 import java.util.function.Consumer;
 
 import graphql.schema.idl.TypeRuntimeWiring;
+import org.assertj.core.api.InstanceOfAssertFactories;
 import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.Test;
 import reactor.core.publisher.Mono;
@@ -263,13 +264,18 @@ void shouldConfigureWebSocketBeans() {
 	void shouldConfigureWebSocketProperties() {
 		this.contextRunner
 			.withPropertyValues("spring.graphql.websocket.path=/ws",
-					"spring.graphql.websocket.connection-init-timeout=120s", "spring.graphql.websocket.keep-alive=30s")
+					"spring.graphql.websocket.connection-init-timeout=120s", "spring.graphql.websocket.keep-alive=30s",
+					"spring.graphql.cors.allowed-origins=https://example.com")
 			.run((context) -> {
 				assertThat(context).hasSingleBean(GraphQlWebSocketHandler.class);
 				GraphQlWebSocketHandler graphQlWebSocketHandler = context.getBean(GraphQlWebSocketHandler.class);
 				assertThat(graphQlWebSocketHandler).extracting("initTimeoutDuration")
 					.isEqualTo(Duration.ofSeconds(120));
 				assertThat(graphQlWebSocketHandler).extracting("keepAliveDuration").isEqualTo(Duration.ofSeconds(30));
+				assertThat(graphQlWebSocketHandler).extracting("corsConfiguration")
+					.extracting("allowedOrigins")
+					.asInstanceOf(InstanceOfAssertFactories.LIST)
+					.containsExactly("https://example.com");
 			});
 	}
 

module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfigurationTests.java

@@ -21,6 +21,7 @@
 import java.util.Optional;
 
 import graphql.schema.idl.TypeRuntimeWiring;
+import org.assertj.core.api.InstanceOfAssertFactories;
 import org.assertj.core.api.ThrowingConsumer;
 import org.junit.jupiter.api.Test;
 
@@ -243,13 +244,18 @@ void shouldConfigureWebSocketBeans() {
 	void shouldConfigureWebSocketProperties() {
 		this.contextRunner
 			.withPropertyValues("spring.graphql.websocket.path=/ws",
-					"spring.graphql.websocket.connection-init-timeout=120s", "spring.graphql.websocket.keep-alive=30s")
+					"spring.graphql.websocket.connection-init-timeout=120s", "spring.graphql.websocket.keep-alive=30s",
+					"spring.graphql.cors.allowed-origins=https://example.com")
 			.run((context) -> {
 				assertThat(context).hasSingleBean(GraphQlWebSocketHandler.class);
 				GraphQlWebSocketHandler graphQlWebSocketHandler = context.getBean(GraphQlWebSocketHandler.class);
 				assertThat(graphQlWebSocketHandler).extracting("initTimeoutDuration")
 					.isEqualTo(Duration.ofSeconds(120));
 				assertThat(graphQlWebSocketHandler).extracting("keepAliveDuration").isEqualTo(Duration.ofSeconds(30));
+				assertThat(graphQlWebSocketHandler).extracting("corsConfiguration")
+					.extracting("allowedOrigins")
+					.asInstanceOf(InstanceOfAssertFactories.LIST)
+					.containsExactly("https://example.com");
 			});
 	}
 

platform/spring-boot-dependencies/build.gradle

@@ -2572,7 +2572,7 @@ bom {
 			releaseNotes("https://github.com/spring-projects/spring-framework/releases/tag/v{version}")
 		}
 	}
-	library("Spring GraphQL", "2.0.3") {
+	library("Spring GraphQL", "2.0.4-SNAPSHOT") {
 		considerSnapshots()
 		group("org.springframework.graphql") {
 			modules = [