From c0a7f45fe8135e52177e4f9bc4028df2228d2fb7 Mon Sep 17 00:00:00 2001 From: root Date: Sun, 14 Sep 2025 16:33:22 +0500 Subject: [PATCH] . --- .../api_gateway/filter/CorsHeaderFilter.java | 58 +++++++++++++------ 1 file changed, 40 insertions(+), 18 deletions(-) diff --git a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java index 2185263..6ace78e 100644 --- a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java +++ b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java @@ -16,30 +16,52 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered { @Override public Mono filter(ServerWebExchange exchange, GatewayFilterChain chain) { ServerHttpRequest request = exchange.getRequest(); - ServerHttpResponse response = exchange.getResponse(); - HttpHeaders headers = response.getHeaders(); - - // Always set CORS headers first - String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN); - if (origin != null && isAllowedOrigin(origin)) { - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin); - } else { - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz"); - } - - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS"); - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*"); - headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); - headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600"); // Handle preflight requests immediately if (request.getMethod().name().equals("OPTIONS")) { + ServerHttpResponse response = exchange.getResponse(); + HttpHeaders headers = response.getHeaders(); + + // Set CORS headers for preflight + String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN); + if (origin != null && isAllowedOrigin(origin)) { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin); + } else { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz"); + } + + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); + headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600"); + response.setStatusCode(org.springframework.http.HttpStatus.OK); return Mono.empty(); } - // For non-preflight requests, continue to downstream service - return chain.filter(exchange); + // For non-preflight requests, process after downstream service responds + return chain.filter(exchange).then(Mono.fromRunnable(() -> { + ServerHttpResponse response = exchange.getResponse(); + HttpHeaders headers = response.getHeaders(); + + // Check if downstream service already set CORS headers + boolean hasCorsOrigin = headers.containsKey(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN); + + // Only override CORS headers if downstream service didn't set them + if (!hasCorsOrigin) { + String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN); + if (origin != null && isAllowedOrigin(origin)) { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin); + } else { + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz"); + } + + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*"); + headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); + headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600"); + } + })); } private boolean isAllowedOrigin(String origin) { @@ -52,6 +74,6 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered { @Override public int getOrder() { - return -1; // High priority to run before other filters + return 1000; // Low priority to run after downstream services } }