spring-cloud / spring-cloud/spring-cloud-gateway

Configuration attribute to disable CORS processing when response already has CORS headers

Open
#2,782 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feedback-provided
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Is your feature request related to a problem? Please describe.
When proxied services already set CORS headers, I end up with double headers definition and CORS error in web browser.

All solutions that I found so far to disable CORS actually just allow any origin for any kind of requests, which sets headers and lead to the error I face.

Describe the solution you'd like
I'd like a configuration option to disable completely corsProcessor in AbstractHandlerMapping when a response already carries Access-Control-Allow-* headers (not override nor add header with the same name)

Describe alternatives you've considered
First solution is to disable CORS in downstream services. This works for resource-servers that I code but sometimes, I just can't disable CORS (like when proxying a Keycloak server). Also, web-applications can't use the resource-servers directly anymore.

Other solution I found is to explicitely setResponseHeader in a filter. This de-duplicates headers but resource-servers CORS headers are lost (as explained earlier, I'd prefer to use those original headers only):

	@Bean
	public RouteLocator myRoutes(RouteLocatorBuilder builder, Function<GatewayFilterSpec, UriSpec> brutalCorsFilters) {
		return builder.routes().route(p -> p.path("/users/**").filters(brutalCorsFilters).uri("https://localhost:9443"))
				.route(p -> p.path("/greet/**").filters(brutalCorsFilters).uri("https://localhost:9445"))
				.route(p -> p.path("/realms/**").filters(brutalCorsFilters).uri("https://localhost:8443"))
				.build();
	}

	@Bean
	Function<GatewayFilterSpec, UriSpec> brutalCorsFilters() {
		// use something more restrictive in production
		return f -> f
				.setResponseHeader("Access-Control-Allow-Origin", "*")
				.setResponseHeader("Access-Control-Allow-Methods", "*")
				.setResponseHeader("Access-Control-Allow-headers", "*")
				.setResponseHeader("Access-Control-Expose-Headers", "*");
	}

with this properties:

spring.cloud.gateway.globalcors.add-to-simple-url-handler-mapping=true
spring.cloud.gateway.globalcors.corsConfigurations.[/**].allowed-origins=*
spring.cloud.gateway.globalcors.corsConfigurations.[/**].allowed-headers=*
spring.cloud.gateway.globalcors.corsConfigurations.[/**].allowed-methods=*
spring.cloud.gateway.globalcors.corsConfigurations.[/**].exposed-headers=*

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with Spring's AbstractHandlerMapping and its corsProcessor, then trace the spring.cloud.gateway.globalcors configuration described in the issue. Determine where a configuration option could disable processing when the response already contains Access-Control-Allow-* headers. Done means upstream CORS headers remain unchanged and the gateway does not add duplicate headers.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
api, backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.