Grails 4.1.0 - with CORS disabled, interceptors don't match OPTIONS requests anymore
- Dominant language
- Groovy
- Stars
- 2.9k
- Forks
- 975
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 92
Description
While upgrading my web-app from Grails 4.0.13 to 4.1.0, I noticed something changed with interceptors.
Here’s a simple interceptor
```
class GlobalInterceptor {
int order = HIGHEST_PRECEDENCE
GlobalInterceptor() {
matchAll()
}
boolean before() {
println "[$request.method] Global interceptor"
}
}
```
With Grails 4.1.0 it seems to not match OPTIONS request anymore, when both `Access-Control-Request-Method` and `Origin` headers are present.
Tested with cURL:
`$ curl -I -X OPTIONS 'http://localhost:8080' -H 'Access-Control-Request-Method: POST' -H 'Origin: https://alias:8080'`
No line is printed, while it is with other request methods, e.g. GET.
This is a breaking change for me, as the interceptor logic is quite complex and cannot be emulated via [CORS config](https://docs.grails.org/4.1.x/guide/single.html#cors) and (company policy) I cannot enable CORS for the whole app.
### Environment Information
- OS: MacOS 11.1.2
- JDK 11
- Grails 4.1.0
- Gradle 5.6.4
### Example Application
https://github.com/ilPittiz/unmatchingInterceptor
Contributor guide
Research direction
Start with the linked example application and the GlobalInterceptor shown in the issue, then reproduce the OPTIONS request with both Access-Control-Request-Method and Origin headers using the provided curl command. Done means the interceptor matches this request when CORS is disabled, without requiring CORS to be enabled for the whole application.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- groovy
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100