spring-cloud / spring-cloud/spring-cloud-gateway
CORS error No 'Access-Control-Allow-Origin' header is present on the requested resource
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Hi Everybody,
I am newbie in spring cloud, today when I setup my project and deploy to server, I have error when call API from localhost to server bellow:
Access to XMLHttpRequest at 'xxxx/api/authentication/send-sign-in-code' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
This is my config in application.properties
spring.application.name=gateway
server.port=3012
spring.main.allow-bean-definition-overriding=true
eureka.registerWithEureka=true
eureka.fetchRegistry=true
eureka.client.serviceUrl.defaultZone=http://localhost:1313/eureka
AUTHENTICATION_URL=http://localhost:3011
spring.cloud.gateway.defaultFilters=DedupeResponseHeader=Access-Control-Allow-Origin Access-Control-Allow-Credentials, RETAIN_UNIQUE
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowedOrigins=*
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowedMethods=*
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowedHeaders=*
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowCredentials=true
And I saw log in server:
java.lang.IllegalArgumentException: When allowCredentials is true, allowedOrigins cannot contain the special value "*" since that cannot be set on the "Access-Control-Allow-Origin" response header. To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead.
at org.springframework.web.cors.CorsConfiguration.validateAllowCredentials(CorsConfiguration.java:538) ~[spring-web-6.0.13.jar:6.0.13]
Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:
Error has been observed at the following site(s):
*__checkpoint ⇢ org.springframework.cloud.gateway.filter.WeightCalculatorWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ HTTP OPTIONS "/api/authentication/send-sign-in-code" [ExceptionHandlingWebHandler]
I then changed my configuration back and allowed localhost in allowedOrigins :
spring.cloud.gateway.globalCors.corsConfigurations.[/**].allowedOrigins=http://localhost:3000
and I got another error
Access to XMLHttpRequest at 'xxxxxx/api/authentication/send-sign-in-code' from origin 'http://localhost:3000' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:3000, *', but only one is allowed.
i spent all day looking for the solution but couldn't find it, please help me, thanks
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the CORS settings in application.properties and the logged HTTP OPTIONS request for /api/authentication/send-sign-in-code. Reproduce the preflight request and trace how the gateway applies globalCors and defaultFilters; done means the request completes with one valid Access-Control-Allow-Origin response value and no CORS exception.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100