CODEWITHSUNDEEP
springspring-bootspring-securitycors
ieXcept
ieXcept

Reputation: 1127

Spring CORS Filter problem in light of Spring Cloud microservices with Zuul

Given: angular frontend application sends requests to backend microservice through gateway microservice. The backend is in Spring Cloud.

Question: how to correctly configure CORS filters to get rid of the following error:

Access to XMLHttpRequest at 'http://gateway-service:5555/api/useful-service/myentities/' from origin 'http://localhost:4200' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:4200, http://localhost:4200', but only one is allowed.

That's what I have written so far:

Gateway Service

My main class in the gateway serivice has 3 annotations: @SpringBootApplication, @EnableZuulProxy and @Configuration. So as I don't confgigured any security thing I presume that the Spring Security is not being used therefore I need to configure Spring MVC's CorsFilter. I do that like this (comments are for future searchers):

@Bean
public CorsFilter corsFilter() {
    CorsConfiguration corsConfig = new CorsConfiguration();
    corsConfig.setAllowCredentials(true);
    //corsConfig.addAllowedOrigin("http://localhost:4200");
    corsConfig.addAllowedOrigin("*"); //wildcard that will simply copy the value of the request's Origin header
    // into the value of the Response's Access-Control-Allow-Origin header, effectively allowing all origins.
    // You can add specific origins instead if you wish to limit them.
    corsConfig.addAllowedHeader("*");
    corsConfig.addAllowedMethod("OPTIONS");
    corsConfig.addAllowedMethod("HEAD");
    corsConfig.addAllowedMethod("GET");
    corsConfig.addAllowedMethod("POST");
    corsConfig.addAllowedMethod("PUT");
    corsConfig.addAllowedMethod("DELETE");
    corsConfig.addAllowedMethod("PATCH");
    UrlBasedCorsConfigurationSource configSource = new UrlBasedCorsConfigurationSource();
    configSource.registerCorsConfiguration("/**", corsConfig);
    return new CorsFilter(configSource);
}

Useful Service

The main class over here is annotated with @EnableResourceServer and @SpringBootApplication. According to my "business rules" I would like to have Spring authorization (url security, and in the future the method security also) so as I configured Spring Security in general and OAuth2 and in partucular I should configure security's cors filter as well. Here's relevant security snippet that enables cors:

@Configuration
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .cors(); // by default uses a Bean by the name of corsConfigurationSource
    }
}

And that's how I configure the cors functionality of spring security:

@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("*"));
    configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "DELETE", "PUT", "PATCH"));
    configuration.setAllowedHeaders(Arrays.asList("X-Requested-With", "Origin", "Content-Type", "Accept", "Authorization"));
    configuration.setAllowCredentials(true);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

Unfortunatelly I got the error mentioned above, if you have an idea how to fix it please tale.

Upvotes: 1

Views: 2176

Answers (1)

Hartmut Lang
Hartmut Lang

Reputation: 41

It seems that this problem was fixed with a DedupeResponseHeader-filter. See https://github.com/spring-cloud/spring-cloud-gateway/pull/866

Upvotes: 1

Related Questions