spring-cloud / spring-cloud/spring-cloud-gateway
Configuration attribute to disable CORS processing when response already has CORS headers
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Is your feature request related to a problem? Please describe.
When proxied services already set CORS headers, I end up with double headers definition and CORS error in web browser.
All solutions that I found so far to disable CORS actually just allow any origin for any kind of requests, which sets headers and lead to the error I face.
Describe the solution you'd like
I'd like a configuration option to disable completely corsProcessor in AbstractHandlerMapping when a response already carries Access-Control-Allow-* headers (not override nor add header with the same name)
Describe alternatives you've considered
First solution is to disable CORS in downstream services. This works for resource-servers that I code but sometimes, I just can't disable CORS (like when proxying a Keycloak server). Also, web-applications can't use the resource-servers directly anymore.
Other solution I found is to explicitely setResponseHeader in a filter. This de-duplicates headers but resource-servers CORS headers are lost (as explained earlier, I'd prefer to use those original headers only):
@Bean
public RouteLocator myRoutes(RouteLocatorBuilder builder, Function<GatewayFilterSpec, UriSpec> brutalCorsFilters) {
return builder.routes().route(p -> p.path("/users/**").filters(brutalCorsFilters).uri("https://localhost:9443"))
.route(p -> p.path("/greet/**").filters(brutalCorsFilters).uri("https://localhost:9445"))
.route(p -> p.path("/realms/**").filters(brutalCorsFilters).uri("https://localhost:8443"))
.build();
}
@Bean
Function<GatewayFilterSpec, UriSpec> brutalCorsFilters() {
// use something more restrictive in production
return f -> f
.setResponseHeader("Access-Control-Allow-Origin", "*")
.setResponseHeader("Access-Control-Allow-Methods", "*")
.setResponseHeader("Access-Control-Allow-headers", "*")
.setResponseHeader("Access-Control-Expose-Headers", "*");
}
with this properties:
spring.cloud.gateway.globalcors.add-to-simple-url-handler-mapping=true
spring.cloud.gateway.globalcors.corsConfigurations.[/**].allowed-origins=*
spring.cloud.gateway.globalcors.corsConfigurations.[/**].allowed-headers=*
spring.cloud.gateway.globalcors.corsConfigurations.[/**].allowed-methods=*
spring.cloud.gateway.globalcors.corsConfigurations.[/**].exposed-headers=*
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Spring's AbstractHandlerMapping and its corsProcessor, then trace the spring.cloud.gateway.globalcors configuration described in the issue. Determine where a configuration option could disable processing when the response already contains Access-Control-Allow-* headers. Done means upstream CORS headers remain unchanged and the gateway does not add duplicate headers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- api, backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100