spring-cloud / spring-cloud/spring-cloud-gateway

CORS error No 'Access-Control-Allow-Origin' header is present on the requested resource

Open
#3,135 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

waiting-for-triage
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Hi Everybody,
I am newbie in spring cloud, today when I setup my project and deploy to server, I have error when call API from localhost to server bellow:

Access to XMLHttpRequest at 'xxxx/api/authentication/send-sign-in-code' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

This is my config in application.properties

spring.application.name=gateway
server.port=3012
spring.main.allow-bean-definition-overriding=true

eureka.registerWithEureka=true
eureka.fetchRegistry=true
eureka.client.serviceUrl.defaultZone=http://localhost:1313/eureka

AUTHENTICATION_URL=http://localhost:3011

spring.cloud.gateway.defaultFilters=DedupeResponseHeader=Access-Control-Allow-Origin Access-Control-Allow-Credentials, RETAIN_UNIQUE
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowedOrigins=*
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowedMethods=*
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowedHeaders=*
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowCredentials=true
And I saw log in server: 
java.lang.IllegalArgumentException: When allowCredentials is true, allowedOrigins cannot contain the special value "*" since that cannot be set on the "Access-Control-Allow-Origin" response header. To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead.
        at org.springframework.web.cors.CorsConfiguration.validateAllowCredentials(CorsConfiguration.java:538) ~[spring-web-6.0.13.jar:6.0.13]
        Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException: 
Error has been observed at the following site(s):
        *__checkpoint ⇢ org.springframework.cloud.gateway.filter.WeightCalculatorWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ HTTP OPTIONS "/api/authentication/send-sign-in-code" [ExceptionHandlingWebHandler]

I then changed my configuration back and allowed localhost in allowedOrigins :
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowedOrigins=http://localhost:3000
and I got another error
Access to XMLHttpRequest at 'xxxxxx/api/authentication/send-sign-in-code' from origin 'http://localhost:3000' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:3000, *', but only one is allowed.
i spent all day looking for the solution but couldn't find it, please help me, thanks

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the CORS settings in application.properties and the logged HTTP OPTIONS request for /api/authentication/send-sign-in-code. Reproduce the preflight request and trace how the gateway applies globalCors and defaultFilters; done means the request completes with one valid Access-Control-Allow-Origin response value and no CORS exception.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.