CODEWITHSUNDEEP
spring-bootspring-cloudspring-cloud-netflix
Phate
Phate

Reputation: 6622

How to let the zuul proxy handle the cors?

I have several microservices behind a microservice acting as zuul proxy.

When called from outside the domain the microservices return a "403- Invalid Cors".

This is solved by adding the following to each microservice:

@Configuration
public class CorsConfig extends WebMvcConfigurerAdapter {

@Override
public void addCorsMappings(CorsRegistry registry) {
    registry.addMapping("/**"); //just for the sake of explaination i'm allowing everything
}
}

Anyway this is a bad design: I have a zuul api gateway after all! This should be done by that and the microservices should actually return that error when directly called.

So, I moved that same configuration only to my zuul microservice, here it is by the way:

@SpringBootApplication
@EnableSwagger2
@EnableZuulProxy
@ComponentScan(basePackages = "my.base.package")
public class MyApiGateway extends SpringBootServletInitializer {

@Override
protected SpringApplicationBuilder configure(SpringApplicationBuilder builder) {
    return configureApplication(builder);
}
  ....

The props:

zuul:
 prefix: /api
 routes:
   my-api:
     path: /myApi/**
     url: 'http: ...'
     stripPrefix: true

Problem is that the microservice still returns "403 - Invalid Cors"! What am I doing wrong? I guess this happens because the zuul proxy actually does nothing except to forward the request...but how to configure it so to make the destination MS notice that the request comes from zuul, on the same network and so allowing it?

Upvotes: 0

Views: 3591

Answers (1)

Georg Wittberger
Georg Wittberger

Reputation: 386

At least in the past Spring Cloud did not handle Zuul proxy via Spring MVC framework, so you cannot configure CORS for Zuul using WebMvcConfigurerAdapter, see: https://github.com/spring-cloud/spring-cloud-netflix/issues/888

You could try adding a CorsFilter bean to your Zuul API gateway, see: https://docs.spring.io/spring/docs/5.0.6.RELEASE/spring-framework-reference/web.html#mvc-cors-filter

Or you can add Spring Security to your API gateway which comes with CORS support already integrated, see: https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#cors

Upvotes: 2

Related Questions