From 1a24b6048e35e87c97cbd2544711f8a6c9abc320 Mon Sep 17 00:00:00 2001 From: root Date: Sun, 14 Sep 2025 16:31:52 +0500 Subject: [PATCH] . --- .../api_gateway/filter/CorsHeaderFilter.java | 67 +++++-------------- 1 file changed, 18 insertions(+), 49 deletions(-) diff --git a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java index 1d49b01..2185263 100644 --- a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java +++ b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java @@ -16,61 +16,30 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered { @Override public Mono filter(ServerWebExchange exchange, GatewayFilterChain chain) { ServerHttpRequest request = exchange.getRequest(); + ServerHttpResponse response = exchange.getResponse(); + HttpHeaders headers = response.getHeaders(); + + // Always set CORS headers first + String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN); + if (origin != null && isAllowedOrigin(origin)) { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin); + } else { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz"); + } + + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); + headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600"); // Handle preflight requests immediately if (request.getMethod().name().equals("OPTIONS")) { - ServerHttpResponse response = exchange.getResponse(); - HttpHeaders headers = response.getHeaders(); - - // Clear any existing CORS headers - headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN); - headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS); - headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS); - headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS); - headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE); - - // Set CORS headers for preflight - String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN); - if (origin != null && isAllowedOrigin(origin)) { - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin); - } else { - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz"); - } - - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS"); - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*"); - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); - headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600"); - response.setStatusCode(org.springframework.http.HttpStatus.OK); return Mono.empty(); } - // For non-preflight requests, process after the downstream service responds - return chain.filter(exchange).then(Mono.fromRunnable(() -> { - ServerHttpResponse response = exchange.getResponse(); - HttpHeaders headers = response.getHeaders(); - - // Clear any existing CORS headers from downstream service - headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN); - headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS); - headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS); - headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS); - headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE); - - // Set our CORS headers - String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN); - if (origin != null && isAllowedOrigin(origin)) { - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin); - } else { - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz"); - } - - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS"); - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*"); - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); - headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600"); - })); + // For non-preflight requests, continue to downstream service + return chain.filter(exchange); } private boolean isAllowedOrigin(String origin) { @@ -83,6 +52,6 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered { @Override public int getOrder() { - return 1000; // Low priority to run after other filters and downstream services + return -1; // High priority to run before other filters } }