spring-cloud / spring-cloud/spring-cloud-gateway
CORS not work in springboot gateway 4.1.5
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Describe the bug
I checked two configuration options without success:
- First Option: global cors configuration
server:
port: 8080
management:
endpoint:
health:
probes:
enabled: true
spring:
servlet:
multipart:
max-file-size: 500MB
max-request-size: 500MB
application:
name: uniovi-avib-morphingprojections-gateway
cloud:
gateway:
globalcors:
add-to-simple-url-handler-mapping: true
cors-configurations:
'[/**]':
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
routes:
- id: BACKEND_USER
uri: http://localhost:8082
predicates:
- Path=/users/**
- id: BACKEND_ORGANIZATION
uri: http://localhost:8082
predicates:
- Path=/organizations/**
- id: BACKEND_PROJECT
uri: http://localhost:8082
predicates:
- Path=/projects/**
- id: BACKEND_CASE
uri: http://localhost:8082
predicates:
- Path=/cases/**
- id: BACKEND_ANNOTATION
uri: http://localhost:8081
predicates:
- Path=/annotations/**
- id: BACKEND_IMAGE
uri: http://localhost:8082
predicates:
- Path=/images/**
- id: BACKEND_RESOURCE
uri: http://localhost:8082
predicates:
- Path=/resources/**
- id: BACKEND_PROJECTION
uri: http://localhost:8083
predicates:
- Path=/projections/**
- id: BACKEND_JOB
uri: http://localhost:8084
predicates:
- Path=/jobs/**
- id: BACKEND_ANALYTICS
uri: http://localhost:5000
predicates:
- Path=/analytics/**
- Second Option: local cors configuration from each route
server:
port: 8080
management:
endpoint:
health:
probes:
enabled: true
spring:
servlet:
multipart:
max-file-size: 500MB
max-request-size: 500MB
application:
name: uniovi-avib-morphingprojections-gateway
cloud:
gateway:
routes:
- id: BACKEND_USER
uri: http://localhost:8082
predicates:
- Path=/users/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
- id: BACKEND_ORGANIZATION
uri: http://localhost:8082
predicates:
- Path=/organizations/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
- id: BACKEND_PROJECT
uri: http://localhost:8082
predicates:
- Path=/projects/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
- id: BACKEND_CASE
uri: http://localhost:8082
predicates:
- Path=/cases/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
- id: BACKEND_ANNOTATION
uri: http://localhost:8081
predicates:
- Path=/annotations/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
- id: BACKEND_IMAGE
uri: http://localhost:8082
predicates:
- Path=/images/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
- id: BACKEND_RESOURCE
uri: http://localhost:8082
predicates:
- Path=/resources/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
- id: BACKEND_PROJECTION
uri: http://localhost:8083
predicates:
- Path=/projections/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
- id: BACKEND_JOB
uri: http://localhost:8084
predicates:
- Path=/jobs/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
- id: BACKEND_ANALYTICS
uri: http://localhost:5000
predicates:
- Path=/analytics/**
metadata:
cors:
allowedOrigins: "http://localhost:4200"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
Sample
The results when try to acces to any url from my angular app is the same usinf both options:
The 'Access to XMLHttpRequest at 'http://localhost:8080/users/admin@acme.io/email' from origin 'http://localhost:4200' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:4200, *', but only one is allowed', but only one is allowed
NOTE:
- Using postman requesting from 'http://localhost:8080/users/admin@acme.io/email works ok
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the Angular request from http://localhost:4200 through the listed Spring Cloud Gateway routes, using the global CORS and per-route metadata configurations shown in the report. Inspect the response headers and gateway-to-backend path to identify why Access-Control-Allow-Origin contains both the configured origin and *, then verify that each response contains only the intended CORS value.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100