From 314b0be03c469e37bdf21b302b34a014a0d615e3 Mon Sep 17 00:00:00 2001 From: root Date: Sun, 14 Sep 2025 16:40:03 +0500 Subject: [PATCH] . --- .../api_gateway/filter/CorsHeaderFilter.java | 81 ++++++++++++------- 1 file changed, 50 insertions(+), 31 deletions(-) diff --git a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java index 9c9cfdf..1d49b01 100644 --- a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java +++ b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java @@ -16,42 +16,61 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered { @Override public Mono filter(ServerWebExchange exchange, GatewayFilterChain chain) { ServerHttpRequest request = exchange.getRequest(); - String path = request.getPath().value(); - String method = request.getMethod().name(); - - // Log for debugging - System.out.println("CORS Filter - Path: " + path + ", Method: " + method); - - // Always set CORS headers first - ServerHttpResponse response = exchange.getResponse(); - HttpHeaders headers = response.getHeaders(); - - String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN); - System.out.println("Origin: " + origin); - - if (origin != null && isAllowedOrigin(origin)) { - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin); - } else { - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz"); - } - - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS"); - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*"); - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); - headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600"); // Handle preflight requests immediately - if (method.equals("OPTIONS")) { - System.out.println("Handling OPTIONS preflight request for: " + path); - System.out - .println("CORS headers set for preflight: " + headers.get(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN)); + if (request.getMethod().name().equals("OPTIONS")) { + ServerHttpResponse response = exchange.getResponse(); + HttpHeaders headers = response.getHeaders(); + + // Clear any existing CORS headers + headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN); + headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS); + headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS); + headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS); + headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE); + + // Set CORS headers for preflight + String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN); + if (origin != null && isAllowedOrigin(origin)) { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin); + } else { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz"); + } + + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); + headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600"); + response.setStatusCode(org.springframework.http.HttpStatus.OK); return Mono.empty(); } - // For non-preflight requests, continue to downstream service - System.out.println("Forwarding request to downstream service: " + path); - return chain.filter(exchange); + // For non-preflight requests, process after the downstream service responds + return chain.filter(exchange).then(Mono.fromRunnable(() -> { + ServerHttpResponse response = exchange.getResponse(); + HttpHeaders headers = response.getHeaders(); + + // Clear any existing CORS headers from downstream service + headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN); + headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS); + headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS); + headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS); + headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE); + + // Set our CORS headers + String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN); + if (origin != null && isAllowedOrigin(origin)) { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin); + } else { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz"); + } + + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); + headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600"); + })); } private boolean isAllowedOrigin(String origin) { @@ -64,6 +83,6 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered { @Override public int getOrder() { - return -1; // High priority to run before other filters + return 1000; // Low priority to run after other filters and downstream services } }