digiops/api-gateway
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

.

Browse Source
This commit is contained in:
root
2025-09-14 16:33:22 +05:00
parent 1a24b6048e
commit c0a7f45fe8
1 changed files with 40 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java
+28 -6
View File
@@ -16,10 +16,13 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered {
@Override
public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
ServerHttpRequest request = exchange.getRequest();
// Handle preflight requests immediately
if (request.getMethod().name().equals("OPTIONS")) {
ServerHttpResponse response = exchange.getResponse();
HttpHeaders headers = response.getHeaders();
// Always set CORS headers first
// Set CORS headers for preflight
String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
if (origin != null && isAllowedOrigin(origin)) {
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
@@ -32,14 +35,33 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered {
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
// Handle preflight requests immediately
if (request.getMethod().name().equals("OPTIONS")) {
response.setStatusCode(org.springframework.http.HttpStatus.OK);
return Mono.empty();
}
// For non-preflight requests, continue to downstream service
return chain.filter(exchange);
// For non-preflight requests, process after downstream service responds
return chain.filter(exchange).then(Mono.fromRunnable(() -> {
ServerHttpResponse response = exchange.getResponse();
HttpHeaders headers = response.getHeaders();
// Check if downstream service already set CORS headers
boolean hasCorsOrigin = headers.containsKey(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
// Only override CORS headers if downstream service didn't set them
if (!hasCorsOrigin) {
String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
if (origin != null && isAllowedOrigin(origin)) {
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
} else {
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz");
}
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS");
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*");
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
}
}));
}
private boolean isAllowedOrigin(String origin) {
@@ -52,6 +74,6 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered {
@Override
public int getOrder() {
return -1; // High priority to run before other filters
return 1000; // Low priority to run after downstream services
}
}