-
Notifications
You must be signed in to change notification settings - Fork 38.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Provide API to Expose the Handling of PreFlight Requests in WebFlux #26257
Comments
This would solve this issue. The bug in Spring Boot causes pre-flight requests to the actuator endpoints to be rejected with the default security configuration. This can be fixed by adding The bug exists in Spring Boot 2.2.x so it would be good to get a fix in Spring Framework 5.2.x. |
I'm scheduling tentatively for 5.3.x but I don't know yet how this will be addressed. The most obvious way to address this is to map the request to a target handler but performing full request mapping twice per request is hardly a good place to be. Either we can find a more optimal way to do it, or it is worth questioning whether we have the right approach to begin with. |
1. Update the HandlerMapping contract to state that CORS checks are expected to be applied before returning a handler. 2. DispatcherHandler checks explicitly for pre-flight requests or CORS failed requests and skips handling for both. Technically no change since AbstractHandlerMapping already returns a NO_OP_HANDLER for those cases. The purpose however is for the DispatcherHandler to also guarantee more explicitly that no such handling can take place for such cases. As one consequence, this makes it possible to invoke the DispatcherHandler from anywhere in the WebFilter chain in order to "handle" a pre-flight request, and then skip the rest of the WebFilter chain. See gh-26257
|
Spring MVC provides
HandlerMappingIntrospector
which exposes theHandlerMapping
s CORS configuration through theCorsConfigurationSource
interface. WebFlux allows users to register aCorsConfigurationSource
throughAbstractHandlerMapping
, but does not provide a way for looking up the CORS configuration. This is important because in order for CORS to work with Spring Security theCorsWebFilter
needs to be placed after the headers but before authorization. We want to inject headers, but preflight requests will not contain credentials in them so all authorization will be rejected.It would be nice if WebFlux allowed for exposing the CORS configuration similar to how MVC does.
The text was updated successfully, but these errors were encountered: