digiops/api-gateway
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cors header

Browse Source
This commit is contained in:
root
2025-09-14 15:56:42 +05:00
parent 725f719ed7
commit cfcba5b56d
1 changed files with 58 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java
+55 -38
View File
@@ -10,62 +10,79 @@ import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange; import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono; import reactor.core.publisher.Mono;
import java.util.List;
@Component @Component
public class CorsHeaderFilter implements GlobalFilter, Ordered { public class CorsHeaderFilter implements GlobalFilter, Ordered {
@Override @Override
public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) { public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
ServerHttpRequest request = exchange.getRequest(); ServerHttpRequest request = exchange.getRequest();
ServerHttpResponse response = exchange.getResponse();
// Add CORS headers to response // Handle preflight requests immediately
HttpHeaders headers = response.getHeaders();
// Remove any existing CORS headers to prevent duplication
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS);
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS);
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS);
headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE);
// Get the origin from the request
String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
// Set CORS headers based on the origin
if (origin != null && isAllowedOrigin(origin)) {
headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
} else {
headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz");
}
headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS");
headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*");
headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
headers.add(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
// Handle preflight requests
if (request.getMethod().name().equals("OPTIONS")) { if (request.getMethod().name().equals("OPTIONS")) {
ServerHttpResponse response = exchange.getResponse();
HttpHeaders headers = response.getHeaders();
// Clear any existing CORS headers
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS);
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS);
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS);
headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE);
// Set CORS headers for preflight
String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
if (origin != null && isAllowedOrigin(origin)) {
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
} else {
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz");
}
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS");
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*");
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
response.setStatusCode(org.springframework.http.HttpStatus.OK); response.setStatusCode(org.springframework.http.HttpStatus.OK);
return Mono.empty(); return Mono.empty();
} }
return chain.filter(exchange); // For non-preflight requests, process after the downstream service responds
return chain.filter(exchange).then(Mono.fromRunnable(() -> {
ServerHttpResponse response = exchange.getResponse();
HttpHeaders headers = response.getHeaders();
// Clear any existing CORS headers from downstream service
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS);
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS);
headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS);
headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE);
// Set our CORS headers
String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
if (origin != null && isAllowedOrigin(origin)) {
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
} else {
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz");
}
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS");
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*");
headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
}));
} }
private boolean isAllowedOrigin(String origin) { private boolean isAllowedOrigin(String origin) {
return origin != null && ( return origin != null && (origin.equals("https://konturai.kz") ||
origin.equals("https://konturai.kz") || origin.startsWith("http://localhost:") ||
origin.startsWith("http://localhost:") || origin.startsWith("http://127.0.0.1:") ||
origin.startsWith("http://127.0.0.1:") || origin.startsWith("https://localhost:") ||
origin.startsWith("https://localhost:") || origin.startsWith("https://127.0.0.1:"));
origin.startsWith("https://127.0.0.1:")
);
} }
@Override @Override
public int getOrder() { public int getOrder() {
return -1; // High priority to run before other filters return 1000; // Low priority to run after other filters and downstream services
} }
} }