apache / apache/grails-core

Grails 4.1.0 - with CORS disabled, interceptors don't match OPTIONS requests anymore

Open
#12,541 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

While upgrading my web-app from Grails 4.0.13 to 4.1.0, I noticed something changed with interceptors.
Here’s a simple interceptor

```
class GlobalInterceptor {

int order = HIGHEST_PRECEDENCE

GlobalInterceptor() {
matchAll()
}

boolean before() {
println "[$request.method] Global interceptor"
}
}
```

With Grails 4.1.0 it seems to not match OPTIONS request anymore, when both `Access-Control-Request-Method` and `Origin` headers are present.
Tested with cURL:
`$ curl -I -X OPTIONS 'http://localhost:8080' -H 'Access-Control-Request-Method: POST' -H 'Origin: https://alias:8080'`

No line is printed, while it is with other request methods, e.g. GET.

This is a breaking change for me, as the interceptor logic is quite complex and cannot be emulated via [CORS config](https://docs.grails.org/4.1.x/guide/single.html#cors) and (company policy) I cannot enable CORS for the whole app.

### Environment Information

- OS: MacOS 11.1.2
- JDK 11
- Grails 4.1.0
- Gradle 5.6.4

### Example Application

https://github.com/ilPittiz/unmatchingInterceptor

Contributor guide

Open the contributing guide

Research direction

Start with the linked example application and the GlobalInterceptor shown in the issue, then reproduce the OPTIONS request with both Access-Control-Request-Method and Origin headers using the provided curl command. Done means the interceptor matches this request when CORS is disabled, without requiring CORS to be enabled for the whole application.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.