You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2020/08/04 01:21:20 UTC
[GitHub] [apisix] OnlyPiglet opened a new issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
OnlyPiglet opened a new issue #1983:
URL: https://github.com/apache/apisix/issues/1983
### Issue description
when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers, if we set the Access-Control-Allow-Headers * we will get a error from google chrome.
### Environment
* apisix version (cmd: `apisix version`):
* OS:
### Minimal test code / Steps to reproduce the issue
1.
2.
3.
### What's the actual result? (including assertion message & call stack if applicable)
### My way to solve this
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] ShiningRush commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
ShiningRush commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668934571
I will add some validations for plugin, and more some tips in doc.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668925261
@ShiningRush
the cors plugin has returned all needing CORS headers,but if the allow_headers is * ,the current cors will set
Access-Control-Request-Headers:* ，this will be failed when the request is a preflight request.the error sames like ```Request header field * is not allowed by Access-Control-Allow-Headers in preflight response``` in the google chorme
the newest code of cors
```lua
local function set_cors_headers(conf, ctx)
local allow_methods = conf.allow_methods
if allow_methods == "**" then
allow_methods = "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS,CONNECT,TRACE"
end
core.response.set_header("Access-Control-Allow-Origin", ctx.cors_allow_origins)
core.response.set_header("Access-Control-Allow-Methods", allow_methods)
core.response.set_header("Access-Control-Allow-Headers", conf.allow_headers)
core.response.set_header("Access-Control-Max-Age", conf.max_age)
core.response.set_header("Access-Control-Expose-Headers", conf.expose_headers)
if conf.allow_credential then
core.response.set_header("Access-Control-Allow-Credentials", true)
end
end
if ctx.var.request_method == "OPTIONS" then
return 200
end
```
we should set the Access-Control-Allow-Credentials which are the same of the preflight request when the conf.allow_headers is * or **.
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
```lua
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669138419
yes because I will check if this is a preflight request
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669213556
According to the spec, it looks like that `Access-Control-Allow-Method` and `Access-Control-Allow-Headers` are only for preflight request.
https://fetch.spec.whatwg.org/#http-access-control-allow-methods
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
So the only thing need to be restricted is `Access-Control-Expose-Headers`. For example, we can require `Access-Control-Expose-Headers` not to be `*` when `Access-Control-Allow-Credentials: true`.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] membphis closed issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
membphis closed issue #1983:
URL: https://github.com/apache/apisix/issues/1983
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669138419
yes because I will check if this is a preflight request,only when I get the value of Access-Control-Request-Headers then I will set, this issue is just an advice.
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668925261
@ShiningRush
the cors plugin has returned all needing CORS headers,but if the allow_headers is * ,the current cors will set
Access-Control-Request-Headers:* ，this will be failed when the request is a preflight request.
the currnet code of cors
```lua
local function set_cors_headers(conf, ctx)
local allow_methods = conf.allow_methods
if allow_methods == "**" then
allow_methods = "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS,CONNECT,TRACE"
end
core.response.set_header("Access-Control-Allow-Origin", ctx.cors_allow_origins)
core.response.set_header("Access-Control-Allow-Methods", allow_methods)
core.response.set_header("Access-Control-Allow-Headers", conf.allow_headers)
core.response.set_header("Access-Control-Max-Age", conf.max_age)
core.response.set_header("Access-Control-Expose-Headers", conf.expose_headers)
if conf.allow_credential then
core.response.set_header("Access-Control-Allow-Credentials", true)
end
end
if ctx.var.request_method == "OPTIONS" then
return 200
end
```
we should set the Access-Control-Allow-Credentials *,this will cause a cors error,I am sorry I didn't has a capture of this error.
we should set the Access-Control-Allow-Credentials which are the same of the preflight request like this
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
```lua
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669131010
@ShiningRush when it's a preflight request it will contains Access-Control-Request-Headers this should be the allow_headers ,this is what I have done
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669138419
@ShiningRush
yes because I will check if this is a preflight request,only when I get the value of Access-Control-Request-Headers then I will set, this issue is just an advice.It runs normally until now.
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
```lua
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
```
if necessary I will write a test::nginx test for this one
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] membphis commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
membphis commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668348004
@ShiningRush please confirm if it is a bug
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669627579
@spacewander
Yes I agree with you totally,the Access-Control-Expose-Headers can't be * when Access-Control-Allow-Credentials: true is true.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] eminoda edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
eminoda edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-1010737757
CORS Plugins:
````
"cors": {
"allow_credential": false,
"allow_headers": "Content-Type,Fetch-Mode,accept", // fix IE CORS
"allow_methods": "*",
"allow_origins": "*",
"disable": false,
"expose_headers": "*",
"max_age": 5
}
````
Http methods is options preflight request is received "access-control-allow-headers: *", CORS Plugins allow_headers is not working.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] eminoda commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
eminoda commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-1010737757
CORS Plugins:
````
"cors": {
"allow_credential": false,
"allow_headers": "Content-Type,Fetch-Mode,accept", // fix IE CORS
"allow_methods": "*",
"allow_origins": "*",
"disable": false,
"expose_headers": "*",
"max_age": 5
#}
````
Http Methods Options preflight request received "access-control-allow-headers: *", allow_headers is not working.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] eminoda edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
eminoda edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-1010737757
因为 IE 不支持 **Access-Control-Allow-Headers: \*** 的情况，所以在路由 router 中增加了插件 plugins：
````
"cors": {
"allow_credential": false,
"allow_headers": "Content-Type,Fetch-Mode,accept", // fix IE CORS
"allow_methods": "*",
"allow_origins": "*",
"disable": false,
"expose_headers": "*",
"max_age": 5
}
````
但最终接口请求还是收到响应头：**"access-control-allow-headers: \*"**，本来以为是 CORS 插件问题，后来发现在全局 Plugins 页定义了 CORS，发现规则如下：
- 对于非 OPTIONS 的请求，单个路由里 CORS 的配置会覆盖全局配置
- 对于OPTIONS请求，会默认用全局的 CORS 配置
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668925261
@ShiningRush
the cors plugin has returned all needing CORS headers,but if the allow_headers is * ,the current cors will set
Access-Control-Request-Headers:* ，this will be failed when the request is a preflight request.
the currnet code of cors
```lua
local function set_cors_headers(conf, ctx)
local allow_methods = conf.allow_methods
if allow_methods == "**" then
allow_methods = "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS,CONNECT,TRACE"
end
core.response.set_header("Access-Control-Allow-Origin", ctx.cors_allow_origins)
core.response.set_header("Access-Control-Allow-Methods", allow_methods)
core.response.set_header("Access-Control-Allow-Headers", conf.allow_headers)
core.response.set_header("Access-Control-Max-Age", conf.max_age)
core.response.set_header("Access-Control-Expose-Headers", conf.expose_headers)
if conf.allow_credential then
core.response.set_header("Access-Control-Allow-Credentials", true)
end
end
if ctx.var.request_method == "OPTIONS" then
return 200
end
```
we should set the Access-Control-Allow-Credentials *,this will cause a cors error,I am sorry I didn't has a capture of this error.
we shouldn't set the Access-Control-Allow-Credentials which are the same of the preflight request like this
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
```lua
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668925261
@ShiningRush
the cors plugin has returned all needing CORS headers,but if the allow_headers is * ,the current cors will set
Access-Control-Request-Headers:* ，this will be failed when the request is a preflight request.the error sames like ```Request header field * is not allowed by Access-Control-Allow-Headers in preflight response```
the currnet code of cors
```lua
local function set_cors_headers(conf, ctx)
local allow_methods = conf.allow_methods
if allow_methods == "**" then
allow_methods = "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS,CONNECT,TRACE"
end
core.response.set_header("Access-Control-Allow-Origin", ctx.cors_allow_origins)
core.response.set_header("Access-Control-Allow-Methods", allow_methods)
core.response.set_header("Access-Control-Allow-Headers", conf.allow_headers)
core.response.set_header("Access-Control-Max-Age", conf.max_age)
core.response.set_header("Access-Control-Expose-Headers", conf.expose_headers)
if conf.allow_credential then
core.response.set_header("Access-Control-Allow-Credentials", true)
end
end
if ctx.var.request_method == "OPTIONS" then
return 200
end
```
we should set the Access-Control-Allow-Credentials which are the same of the preflight request when the conf.allow_headers is * or **.
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
```lua
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668925261
@ShiningRush
the cors plugin has returned all needing CORS headers,but if the allow_headers is * ,the current cors will set
Access-Control-Request-Headers:* ，this will be failed when the request is a preflight request.the error sames like ```Request header field * is not allowed by Access-Control-Allow-Headers in preflight response``` in the google chorme
the currnet code of cors
```lua
local function set_cors_headers(conf, ctx)
local allow_methods = conf.allow_methods
if allow_methods == "**" then
allow_methods = "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS,CONNECT,TRACE"
end
core.response.set_header("Access-Control-Allow-Origin", ctx.cors_allow_origins)
core.response.set_header("Access-Control-Allow-Methods", allow_methods)
core.response.set_header("Access-Control-Allow-Headers", conf.allow_headers)
core.response.set_header("Access-Control-Max-Age", conf.max_age)
core.response.set_header("Access-Control-Expose-Headers", conf.expose_headers)
if conf.allow_credential then
core.response.set_header("Access-Control-Allow-Credentials", true)
end
end
if ctx.var.request_method == "OPTIONS" then
return 200
end
```
we should set the Access-Control-Allow-Credentials which are the same of the preflight request when the conf.allow_headers is * or **.
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
```lua
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668925261
@ShiningRush
the cors plugin has returned all needing CORS headers,but if the allow_headers is * ,the current cors will set
Access-Control-Request-Headers:* ，this will be failed when the request is a preflight request.
the currnet code of cors
```lua
local function set_cors_headers(conf, ctx)
local allow_methods = conf.allow_methods
if allow_methods == "**" then
allow_methods = "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS,CONNECT,TRACE"
end
core.response.set_header("Access-Control-Allow-Origin", ctx.cors_allow_origins)
core.response.set_header("Access-Control-Allow-Methods", allow_methods)
core.response.set_header("Access-Control-Allow-Headers", conf.allow_headers)
core.response.set_header("Access-Control-Max-Age", conf.max_age)
core.response.set_header("Access-Control-Expose-Headers", conf.expose_headers)
if conf.allow_credential then
core.response.set_header("Access-Control-Allow-Credentials", true)
end
end
if ctx.var.request_method == "OPTIONS" then
return 200
end
```
we should set the Access-Control-Allow-Credentials *,this will cause a cors error,the error sames like
we shouldn't set the Access-Control-Allow-Credentials which are the same of the preflight request like ```Request header field * is not allowed by Access-Control-Allow-Headers in preflight response```
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
```lua
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] ShiningRush commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
ShiningRush commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669133869
Yes, preflight request will contain `Access-Control-Request-Headers`, but normal request does not contain this header(
if i remember correctly ), so we can not reply `ACAH` in normal request, it will cause browser check failed.
Are your code work fine in chrome?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] ShiningRush commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
ShiningRush commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668933618
Fine, I got it.
This not a bug, just a CORS specification, you can not set either `Access-Control-Allow-Origin`, `Access-Control-Allow-Methods`, `Access-Control-Allow-Headers`, `Access-Control-Expose-Headers` to `*` when `Access-Control-Allow-Credentials` be `true`.
the cors plugin can use `**` in this situation at parameter of `allow_origins` and `allow_methods`, this is because plugins convert `**` to concrete values, such as "origin.com", "GET,POST" etc. But the plugin does not implement `**` for `allow_headers`, `expose_headers`, so you should configure concrete values instead of `*`.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] ShiningRush edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
ShiningRush edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668348879
What version are you using?
And please have a look at [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS), preflighted request should return all needing CORS headers.It should not trigger chrome error.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669627579
@spacewander
Yes I agree with you totally,the Access-Control-Expose-Headers can't be * when Access-Control-Allow-Credentials: is true.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] ShiningRush commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
ShiningRush commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-1010744341
the plugin codes look fine, can you sure your plugin setting is as same as you posted?(you can call admin api to check it)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669138419
@ShiningRush
yes because I will check if this is a preflight request,only when I get the value of Access-Control-Request-Headers then I will set, this issue is just an advice.It runs normally until now.
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
```lua
if ctx.var.request_method == "OPTIONS" then
set_allow_headers_options_method(conf,ctx)
return 200
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] ShiningRush commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
ShiningRush commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668348879
What version are you using?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668935902
@ShiningRush
ok,sometimes it's usually be set * or ** ,so it's better to add convert logic as allow_origins and allow_methods of allow_headers, expose_headers
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] ShiningRush commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
ShiningRush commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669634233
I have a try on chrom.It is seem like browser will just check `Access-Control-Allow-Origin` in normal request, so we could implement `**` for `allow_headers`, and add a validation that forbidding use`*` in option when `allow_credential` is true.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] ShiningRush commented on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
ShiningRush commented on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-668944808
I am sorry to say it is hard to implement it for `allow_headers`, `expose_headers`, because the plugin does not know what header should be allowed.The request does not contain the info about both them.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] OnlyPiglet edited a comment on issue #1983: bug: cors when the request is a preflight request we shouldn't set the Access-Control-Allow-Headers *
Posted by GitBox <gi...@apache.org>.
OnlyPiglet edited a comment on issue #1983:
URL: https://github.com/apache/apisix/issues/1983#issuecomment-669138419
@ShiningRush
yes because I will check if this is a preflight request,only when I get the value of Access-Control-Request-Headers then I will set, this issue is just an advice.It runs normally until now.
```lua
local function set_allow_headers_options_method(conf,ctx)
local allow_headers = conf.allow_headers
if allow_headers == "*" or allow_headers == "**" then
local headers = core.request.header(ctx,"Access-Control-Request-Headers")
if headers then
ngx.header["Access-Control-Allow-Headers"] = headers
end
end
end
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org