[GitHub] [apisix] tzssangglass commented on issue #7314: bug: plugin:cors: config expose_headers using "**" has no handle when allow_credential set true

[GitBox <gi...@apache.org>]

tzssangglass commented on issue #7314:
URL: https://github.com/apache/apisix/issues/7314#issuecomment-1178500946

   > Recoding to the document I think It is expected to exposed all headers when `expose_headers` is '**'.
   
   Are you saying that the backend should be able to get the header `cool: cooler` in the client request under the condition `"expose_headers": "**"`?
   
   My reproduction steps are as follows
   
   1. upstream is OpenResty, conf:
   
   ```
   master_process on;
   
   worker_processes 2;
   
   error_log logs/error.log warn;
   pid logs/nginx.pid;
   
   worker_rlimit_nofile 20480;
   
   events {
       accept_mutex off;
       worker_connections 10620;
   }
   
   worker_shutdown_timeout 3;
   
   http {
       server {
           listen 1980;
   
           access_log off;
           location / {
               content_by_lua_block {
                   local get_headers = ngx.req.get_headers
                   for k, v in pairs(get_headers(100)) do
                      ngx.say(k .. ": " .. v)
                   end
               }
           }
       }
   }
   ```
   
   this prints all the headers of the request.
   
   2. config route on APISIX
   
   ```
   curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
   {
       "plugins": {
           "cors": {
               "allow_origins": "**",
               "allow_methods": "**",
               "allow_headers": "**",
               "expose_headers": "**",
               "madx_age": 5,
               "allow_credential": true
           }
       },
       "uri": "/hello",
       "upstream": {
           "scheme": "grpc",
           "type": "roundrobin",
           "nodes": {
               "127.0.0.1:1980": 1
           }
       }
   }'
   
   ```
   
   3. test
   
   ```
   curl http://127.0.0.1:1980/get -H "Foo: Bar" -H "Authorization: Basic Zm9vOmZvbwo="
   host: 127.0.0.1:1980
   accept: */*
   foo: Bar
   user-agent: curl/7.29.0
   authorization: Basic Zm9vOmZvbwo
   ```
   
   `Foo:Bar` has been passed to the backend.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org