spring-cloud / spring-cloud/spring-cloud-gateway
CorsGatewayFilterApplicationListener Does Not Consider Host Predicate When Configuring Cors For Individual Routes
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
I am implementing CORS not on the global level, but on the individual routes level. For my predicates, I do not use the Path Predicate. I use the Host predicate to differentiate each id. In trying to add CORS to each id, I noticed that the CorsGatewayFilterApplicationListener.onApplicationEvent(RefreshRoutesEvent event) method only considers the path predicate.
Here is an example configuration to better illustrate my problem:
spring:
cloud:
gateway:
routes:
- id: host-a
uri: http://hostA
order: 0
predicates:
- Host=HostA
metadata:
cors:
allowedOrigins:
- OriginA
allowedMethods:
- GET
allowedHeaders: '*'
allowCredentials: true
- id: host-b
uri: http://hostB
order: 1
predicates:
- Host=HostB
metadata:
cors:
allowedOrigins:
- OriginB
allowedMethods:
- GET
allowedHeaders: '*'
allowCredentials: true
In the above example, the only allowed origin would be "OriginB" if I made a request to HostA since a Path predicate is not specified.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at CorsGatewayFilterApplicationListener.onApplicationEvent(RefreshRoutesEvent), which currently considers the path predicate when configuring route-level CORS. Verify the Host predicate example with separate HostA and HostB origins, and confirm that each route accepts only its configured origin.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100