OVERVIEW:
Add the ability to define CORS configuration for a route via route properties. #401 added support for global CORS configuration. There's a TODO to implement this functionality since 2018 here: https://github.com/spring-cloud/spring-cloud-gateway/blob/main/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/handler/RoutePredicateHandlerMapping.java#L110. It mentions issue #229 that's already closed. I haven't found any other issue for this so I'm creating a new one. Global CORS configuration can be used to specify a different configuration per path, but this is error-prone because whenever I change route's path I have to remember to update the global CORS config as well. Additionally, this could maybe allow more fine-grained configuration, such as different CORS response for the same path but different HTTP methods? I'm not sure if the spec allows this so scratch this if I'm spewing nonsense.
SOLUTION PROPOSAL:
The declaration of CORS configuration should be the same as the global one minus the path entries (It should map straight to CorsConfiguration instead of Map<String, CorsConfiguration>). It could be added as another nullable field in Route class. If the solution is added via getCorsConfiguration method in RoutePredicateHandlerMapping, it will be called here https://github.com/spring-projects/spring-framework/blob/24b359d51963b2eca4ff748e2d23fdc3b8f676dd/spring-webflux/src/main/java/org/springframework/web/reactive/handler/AbstractHandlerMapping.java#L195. This method combines corsConfigurationSource (which is currently set to the global CORS configuration) with the result of getCorsConfiguration (which would supply non-global CORS configuration). There should be an option like overrideGlobal to use just the non-global config without merging it with the global one. This could be achieved by not calling setCorsConfiguration here https://github.com/spring-cloud/spring-cloud-gateway/blob/main/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/handler/RoutePredicateHandlerMapping.java#L61 if non-local config is present and overrideGlobal is true.
OTHER SOLUTIONS:
Maybe global CORS configuration could support route ids instead of paths?
I was surprised this is not implemented. Are there any special considerations for this I should be aware of? I'm willing to try adding this.
OVERVIEW:
Add the ability to define CORS configuration for a route via route properties. #401 added support for global CORS configuration. There's a TODO to implement this functionality since 2018 here: https://github.com/spring-cloud/spring-cloud-gateway/blob/main/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/handler/RoutePredicateHandlerMapping.java#L110. It mentions issue #229 that's already closed. I haven't found any other issue for this so I'm creating a new one. Global CORS configuration can be used to specify a different configuration per path, but this is error-prone because whenever I change route's path I have to remember to update the global CORS config as well. Additionally, this could maybe allow more fine-grained configuration, such as different CORS response for the same path but different HTTP methods? I'm not sure if the spec allows this so scratch this if I'm spewing nonsense.
SOLUTION PROPOSAL:
The declaration of CORS configuration should be the same as the global one minus the path entries (It should map straight to
CorsConfigurationinstead ofMap<String, CorsConfiguration>). It could be added as another nullable field in Route class. If the solution is added viagetCorsConfigurationmethod inRoutePredicateHandlerMapping, it will be called here https://github.com/spring-projects/spring-framework/blob/24b359d51963b2eca4ff748e2d23fdc3b8f676dd/spring-webflux/src/main/java/org/springframework/web/reactive/handler/AbstractHandlerMapping.java#L195. This method combinescorsConfigurationSource(which is currently set to the global CORS configuration) with the result ofgetCorsConfiguration(which would supply non-global CORS configuration). There should be an option likeoverrideGlobalto use just the non-global config without merging it with the global one. This could be achieved by not callingsetCorsConfigurationhere https://github.com/spring-cloud/spring-cloud-gateway/blob/main/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/handler/RoutePredicateHandlerMapping.java#L61 if non-local config is present andoverrideGlobalis true.OTHER SOLUTIONS:
Maybe global CORS configuration could support route ids instead of paths?
I was surprised this is not implemented. Are there any special considerations for this I should be aware of? I'm willing to try adding this.