spring-cloud/spring-cloud-gateway

CorsGatewayFilterApplicationListener Does Not Consider Host Predicate When Configuring Cors For Individual Routes

Open

#3,278 opened on Feb 26, 2024

View on GitHub
 (0 comments) (1 reaction) (0 assignees)Java (3,204 forks)batch import
enhancementhelp wanted

Repository metrics

Stars
 (4,284 stars)
PR merge metrics
 (Avg merge 2d 2h) (15 merged PRs in 30d)

Description

I am implementing CORS not on the global level, but on the individual routes level. For my predicates, I do not use the Path Predicate. I use the Host predicate to differentiate each id. In trying to add CORS to each id, I noticed that the CorsGatewayFilterApplicationListener.onApplicationEvent(RefreshRoutesEvent event) method only considers the path predicate.

Here is an example configuration to better illustrate my problem:

spring:
  cloud:
    gateway:
      routes:
        - id: host-a
          uri: http://hostA
          order: 0
          predicates:
            - Host=HostA
          metadata:
            cors:
              allowedOrigins:
                - OriginA
              allowedMethods:
                - GET
              allowedHeaders: '*'
              allowCredentials: true
        - id: host-b
          uri: http://hostB
          order: 1
          predicates:
            - Host=HostB
          metadata:
            cors:
              allowedOrigins:
                - OriginB
              allowedMethods:
                - GET
              allowedHeaders: '*'
              allowCredentials: true

In the above example, the only allowed origin would be "OriginB" if I made a request to HostA since a Path predicate is not specified.

Contributor guide

Research direction
The issue is in CorsGatewayFilterApplicationListener which only uses Path predicate for CORS configuration per route. To fix, examine how the listener reads route predicates and extend it to support Host and other predicate types. The relevant file is likely CorsGatewayFilterApplicationListener.java in spring cloud gateway. Look at how route metadata is processed and propose a change to evaluate all predicates or at least Host alongside Path.
Tech stack
java
Domain
backendapi
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
familiarity with Spring Cloud Gatewayunderstanding of CORS configuration
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35