500 when CORS and CircuitBreaker are aplied to the same route about spring-cloud-gateway

[spencergibb]

Closing in favor of #3357

[abelsromero]

If we remove the header before we dispatch the request in the circuit breaker filter we can avoid the CORS filter. At least that is the one solution I thought of.

Funny, we were discussing this with @spikymonkey before. In theory yes, but I assume you want those headers to be forwarded also to the fallback service. In case they want to validate CORS at that level too.

[ryanjbaxter]

Thats what I was wondering, but if the fallback URL is forward and the CORS has already been validated before the CB is tripped and we are therefore just forwarding the request to another endpoint in the gateway I don't think we need to validate CORS again.

[ryanjbaxter]

I took a look at this today, but I am unsure what the right path forward may be.

I am wondering if the Cors configuration should even come into play when the URI is forward:/ since we are forwarding the request to ourselves?

@spencergibb what do you think?

[abelsromero]

From the top of my head, the CORS components come from spring-web and it's a Global Web Filter, not a SCG Filter. So I thought it could not be disabled per route.
I kind of expected the solution would be to resolve the forward:/ URL to avoid passing a relative value. Isn't it the case?

[ryanjbaxter]

Ah you are right about the CORS filter. When I was debugging the code I was not paying attention to the package and I just assumed it was handled by the Gateway.

Either way it seems like the CORS filter is based off the presence of the Origin header being present.
https://github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/cors/reactive/CorsUtils.java#L44

If we remove the header before we dispatch the request in the circuit breaker filter we can avoid the CORS filter. At least that is the one solution I thought of.

[spencergibb]

I am wondering if the Cors configuration should even come into play when the URI is forward:/ since we are forwarding the request to ourselves?

Sounds right

I kind of expected the solution would be to resolve the forward:/ URL to avoid passing a relative value.

No, there's nothing to resolve. It's always relative, it can never be a full url.

[spencergibb]

If we remove the header before we dispatch the request in the circuit breaker filter we can avoid the CORS filter.

I can't think of another solution than this. Modify ForwardRoutingFilter, I think.

[spencergibb]

In fact, we already have a place to manipulate the request for forwarding

spring-cloud-gateway/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/support/ServerWebExchangeUtils.java

Lines 430 to 435 in 66aa480

	public static Mono<Void> handle(DispatcherHandler handler, ServerWebExchange exchange) {
	// remove attributes that may disrupt the forwarded request
	exchange.getAttributes().remove(GATEWAY_PREDICATE_PATH_CONTAINER_ATTR);
	return handler.handle(exchange);
	}