spring-cloud / spring-cloud/spring-cloud-gateway

CorsGatewayFilterApplicationListener Does Not Consider Host Predicate When Configuring Cors For Individual Routes

Open
#3,278 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement help wanted
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

I am implementing CORS not on the global level, but on the individual routes level. For my predicates, I do not use the Path Predicate. I use the Host predicate to differentiate each id. In trying to add CORS to each id, I noticed that the CorsGatewayFilterApplicationListener.onApplicationEvent(RefreshRoutesEvent event) method only considers the path predicate.

Here is an example configuration to better illustrate my problem:

spring:
  cloud:
    gateway:
      routes:
        - id: host-a
          uri: http://hostA
          order: 0
          predicates:
            - Host=HostA
          metadata:
            cors:
              allowedOrigins:
                - OriginA
              allowedMethods:
                - GET
              allowedHeaders: '*'
              allowCredentials: true
        - id: host-b
          uri: http://hostB
          order: 1
          predicates:
            - Host=HostB
          metadata:
            cors:
              allowedOrigins:
                - OriginB
              allowedMethods:
                - GET
              allowedHeaders: '*'
              allowCredentials: true

In the above example, the only allowed origin would be "OriginB" if I made a request to HostA since a Path predicate is not specified.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at CorsGatewayFilterApplicationListener.onApplicationEvent(RefreshRoutesEvent), which currently considers the path predicate when configuring route-level CORS. Verify the Host predicate example with separate HostA and HostB origins, and confirm that each route accepts only its configured origin.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.