spring-cloud / spring-cloud/spring-cloud-gateway

CORS not work in springboot gateway 4.1.5

Open
#3,593 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

waiting-for-triage
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Describe the bug
I checked two configuration options without success:

  • First Option: global cors configuration
server: 
  port: 8080

management:
  endpoint:
    health:
      probes:
        enabled: true

spring:
  servlet:
    multipart:
      max-file-size: 500MB
      max-request-size: 500MB
  application:
    name: uniovi-avib-morphingprojections-gateway
  cloud:
    gateway:
      globalcors:
        add-to-simple-url-handler-mapping: true        
        cors-configurations:
          '[/**]':
            allowedOrigins: "http://localhost:4200"
            allowedMethods: "*"
            allowedHeaders: "*"
            allowCredentials: true
      routes:
        - id: BACKEND_USER
          uri: http://localhost:8082
          predicates:
            - Path=/users/**
        - id: BACKEND_ORGANIZATION
          uri: http://localhost:8082
          predicates:
            - Path=/organizations/**
        - id: BACKEND_PROJECT
          uri: http://localhost:8082
          predicates:
            - Path=/projects/**
        - id: BACKEND_CASE
          uri: http://localhost:8082
          predicates:
            - Path=/cases/**
        - id: BACKEND_ANNOTATION
          uri: http://localhost:8081
          predicates:
            - Path=/annotations/**
        - id: BACKEND_IMAGE
          uri: http://localhost:8082
          predicates:
            - Path=/images/**
        - id: BACKEND_RESOURCE
          uri: http://localhost:8082
          predicates:
            - Path=/resources/**
        - id: BACKEND_PROJECTION
          uri: http://localhost:8083
          predicates:
            - Path=/projections/**
        - id: BACKEND_JOB
          uri: http://localhost:8084
          predicates:
            - Path=/jobs/**
        - id: BACKEND_ANALYTICS
          uri: http://localhost:5000
          predicates:
            - Path=/analytics/**
  • Second Option: local cors configuration from each route
server: 
  port: 8080

management:
  endpoint:
    health:
      probes:
        enabled: true

spring:
  servlet:
    multipart:
      max-file-size: 500MB
      max-request-size: 500MB
  application:
    name: uniovi-avib-morphingprojections-gateway
  cloud:
    gateway:
      routes:
        - id: BACKEND_USER
          uri: http://localhost:8082
          predicates:
            - Path=/users/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true
        - id: BACKEND_ORGANIZATION
          uri: http://localhost:8082
          predicates:
            - Path=/organizations/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true            
        - id: BACKEND_PROJECT
          uri: http://localhost:8082
          predicates:
            - Path=/projects/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true            
        - id: BACKEND_CASE
          uri: http://localhost:8082
          predicates:
            - Path=/cases/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true            
        - id: BACKEND_ANNOTATION
          uri: http://localhost:8081
          predicates:
            - Path=/annotations/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true            
        - id: BACKEND_IMAGE
          uri: http://localhost:8082
          predicates:
            - Path=/images/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true            
        - id: BACKEND_RESOURCE
          uri: http://localhost:8082
          predicates:
            - Path=/resources/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true            
        - id: BACKEND_PROJECTION
          uri: http://localhost:8083
          predicates:
            - Path=/projections/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true            
        - id: BACKEND_JOB
          uri: http://localhost:8084
          predicates:
            - Path=/jobs/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true            
        - id: BACKEND_ANALYTICS
          uri: http://localhost:5000
          predicates:
            - Path=/analytics/**
          metadata:
            cors:
              allowedOrigins: "http://localhost:4200"
              allowedMethods: "*"
              allowedHeaders: "*"
              allowCredentials: true

Sample
The results when try to acces to any url from my angular app is the same usinf both options:

The 'Access to XMLHttpRequest at 'http://localhost:8080/users/admin@acme.io/email' from origin 'http://localhost:4200' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:4200, *', but only one is allowed', but only one is allowed

NOTE:

  • Using postman requesting from 'http://localhost:8080/users/admin@acme.io/email works ok

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the Angular request from http://localhost:4200 through the listed Spring Cloud Gateway routes, using the global CORS and per-route metadata configurations shown in the report. Inspect the response headers and gateway-to-backend path to identify why Access-Control-Allow-Origin contains both the configured origin and *, then verify that each response contains only the intended CORS value.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.