Spring Gateway Request blocked by CORS (No Acces0Control-Allow-Orgin header)

Question

I have a Angular frontend, spring cloud gateway and a spring web service. When I try to send GET/POST data to the spring web service through the gateway I get the following error: CORS error. When sending the data directly to the web service it works fine so I think the problem is in the gateway.

In the gateway I have to following files:

@Configuration
@CrossOrigin(origins = "*")
public class SpringCloudConfig {

    @Bean
    public RouteLocator gatewayRoutes(RouteLocatorBuilder builder){
        return builder.routes()
                .route(r -> r.path("/users/**")
                .uri("http://localhost:8081/")
                .id("userService"))

                .route(r -> r.path("/posts/**")
                        .uri("http://localhost:8082/")
                        .id("postService"))

                .route(r -> r.path("/auth/**")
                        .uri("http://localhost:8083/")
                        .id("securityService"))
                .build();
    }

}

application.properties: I thought the server: cloud: etc etc.. would do the trick but no

server.port=8080

spring:
cloud:
gateway:
globalcors:
corsConfigurations:
'[/**]':
allowedOrigins: "*"
allowedMethods:
- GET
- POST

Pom.xml

    <?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.2.6.RELEASE</version>
    <relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>com.cloudGateway</groupId>
<artifactId>gateway</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>gateway</name>
<description>Gateway project for Spring Boot</description>

<properties>
    <java.version>1.8</java.version>
    <spring-cloud.version>Hoxton.SR3</spring-cloud.version>
</properties>

<dependencies>
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-gateway</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
        <exclusions>
            <exclusion>
                <groupId>org.junit.vintage</groupId>
                <artifactId>junit-vintage-engine</artifactId>
            </exclusion>
        </exclusions>
    </dependency>
</dependencies>

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-dependencies</artifactId>
            <version>${spring-cloud.version}</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

CorsConfiguration File:

package com.cloudGateway.gateway;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.reactive.CorsWebFilter;
import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;

import java.util.Arrays;
import java.util.Collections;

@Configuration
public class CorsConfiguration extends org.springframework.web.cors.CorsConfiguration {

    @Bean
    public CorsWebFilter corsWebFilter() {

    final CorsConfiguration corsConfig = new CorsConfiguration();
    corsConfig.setAllowedOrigins(Collections.singletonList("*"));
    corsConfig.setMaxAge(3600L);
    corsConfig.setAllowedMethods(Arrays.asList("GET", "POST"));
    corsConfig.addAllowedHeader("*");

    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", corsConfig);

    return new CorsWebFilter(source);
}

Gateway Repo: https://github.com/KylevanRaaij/Gateway

Service to connect to: https://github.com/KylevanRaaij/UserService (this one works when connecting direct) (for example my angular project)

I added the pom.xml. I also added the repo for if you need to see more files — Kyle Van Raay, Apr 13 '20 at 16:51
Would you min helping here: https://stackoverflow.com/questions/73357127/spring-cloud-apigw-spring-boot-and-openapi-issue-cors-issue — PAA, Aug 15 '22 at 06:30

Mykhailo Moskura · Accepted Answer · 2020-04-13T17:03:22.523

23

Spring documentation tells its enough to declare such configuration in application.yml

spring:
  cloud:
    gateway:
      globalcors:
        corsConfigurations:
          '[/**]':
            allowedOrigins: "*"
            allowedMethods:
            - GET
            - POST

Also you can define your custom CorsConfiguration :

@Configuration
public class CorsConfiguration{
    @Bean
    public CorsWebFilter corsWebFilter() {

        final CorsConfiguration corsConfig = new CorsConfiguration();
        corsConfig.setAllowedOrigins(Collections.singletonList("*"));
        corsConfig.setMaxAge(3600L);
        corsConfig.setAllowedMethods(Arrays.asList("GET", "POST"));
        corsConfig.addAllowedHeader("*");

        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", corsConfig);

        return new CorsWebFilter(source);
    }  
}

edited Apr 13 '20 at 17:03

answered Apr 13 '20 at 14:39

Mykhailo Moskura

2,073
1
9
20

Where do I need to put this CrosWebFilter? Do I need to create a CustomCorsConfigration class (because it doesnt exist) and the return CrosWebFilter expects a CorsConfigurationSource but a UrlBasedCorsConfigurationSource is used here – Kyle Van Raay Apr 13 '20 at 15:50
What version of spring cloud gateway you are using ? – Mykhailo Moskura Apr 13 '20 at 15:52
I use the spring boot version 2.2.6 – Kyle Van Raay Apr 13 '20 at 15:56
And in the pom.xml i see that I use 0.0.1 -snapshot for the cloud gateway. I created this project 2 days ago so I would think I have the latest version – Kyle Van Raay Apr 13 '20 at 15:57
If you copy in your project this code snippet do you have compilation errors? – Mykhailo Moskura Apr 13 '20 at 16:51
Yes, CustomCorsConfiguration doesn't exist and the corsConfig in source.registerCorsConfiguration expects a CorsConfiguration instead of a CustomCorsConfiguration – Kyle Van Raay Apr 13 '20 at 16:57
Sorry , one moment – Mykhailo Moskura Apr 13 '20 at 17:02
Update ,please try – Mykhailo Moskura Apr 13 '20 at 17:03
The errors are gone, and the error is now a bit different https://imgur.com/a/N0PNzmH. I'll also update my post – Kyle Van Raay Apr 13 '20 at 17:14
Can you please remove global cors configuration from yml ? – Mykhailo Moskura Apr 13 '20 at 17:16
Also please remove @CrossOrigin(origins = "*") – Mykhailo Moskura Apr 13 '20 at 17:30
1

Do you have cors config in another microservices? – Mykhailo Moskura Apr 13 '20 at 17:36
Yes, I didn't think this would be a problem. I also used @CrossOrigins in my other services. When I removed those it all worked. Thank you for everything, you saved me allot of time! – Kyle Van Raay Apr 13 '20 at 17:43
1

Thank you guys for this, I tried some many things that didn't work until I saw this. Thanks once again – Chibuike Mba Feb 02 '21 at 03:59
Would you min helping here: https://stackoverflow.com/questions/73357127/spring-cloud-apigw-spring-boot-and-openapi-issue-cors-issue – PAA Aug 15 '22 at 06:30
How it works for you. With the latest version of Spring Gateway, only reactive dependencies are available. org.springframework.web.course.reactive.CorsWebFilter. And there are no such properties. – alexmntmnk Nov 10 '22 at 12:51

score 23 · Answer 2 · answered May 11 '21 at 11:48

23

This Way it worked for me:

spring:
  application:
    name: API-GATEWAY
  cloud:
    gateway:
      default-filters:
        - DedupeResponseHeader=Access-Control-Allow-Credentials Access-Control-Allow-Origin
      globalcors:
        corsConfigurations:
          '[/**]':
              allowedOrigins: "*"
              allowedMethods: "*"
              allowedHeaders: "*"
      routes:
        - id: USER-SERVICE
          uri: lb://USER-SERVICE
          ...

answered May 11 '21 at 11:48

Malte Svenson

231
2
2

1

for some reason 'default-filters' was key for me, wonder why the spring docs doesn't include this in their example – sbnarra Dec 19 '21 at 18:26
Absolutly works for me. Thanks @Malte bro. – Daniel Rch. Dec 25 '21 at 05:39
Ditto on the `default filters` being needed, but I only needed to add the `Access-Control-Allow-Origin` – RobOhRob Jun 03 '22 at 19:27
Would you min helping here: https://stackoverflow.com/questions/73357127/spring-cloud-apigw-spring-boot-and-openapi-issue-cors-issue – PAA Aug 15 '22 at 06:30
absolutely this is working well. thanks a lot. – Mafei Aug 21 '22 at 22:31
Did the job! Thank you. In my case, I have a SecurityWebFilterChain config that copes with cors (spring security) and I have noticed that I am getting two response headers of Access-Control-Allow-Origin: Access-Control-Allow-Origin: and Access-Control-Allow-Origin: "*" – recies Dec 23 '22 at 22:02

score 2 · Answer 3 · answered Sep 20 '22 at 18:09

Based on this Github issue, by adding this worked for me:

spring:
  cloud:
    gateway:
      default-filters:
        - DedupeResponseHeader=Access-Control-Allow-Credentials Access-Control-Allow-Origin
        - AddResponseHeader=Access-Control-Allow-Origin, *

Italo Oré · Answer 4 · 2022-07-24T03:06:02.063

This worked for me (SPRING & ANGULAR):

Define CorsConfiguration

  @Configuration
  public class CorsConfiguration extends 
  org.springframework.web.cors.CorsConfiguration {

    @Bean
    public CorsWebFilter corsWebFilter() {

        final CorsConfiguration corsConfig = new CorsConfiguration();
        corsConfig.setAllowedOrigins(Collections.singletonList("http://localhost:4200"));
        corsConfig.setMaxAge(3600L);
        corsConfig.setAllowedMethods(Arrays.asList("GET", "POST","PUT", "DELETE"));
        corsConfig.addAllowedHeader("Content-Type");

        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", corsConfig);

        return new CorsWebFilter(source);
    }}

Define application.yml

spring:
  cloud:
    gateway:
      globalcors:
        corsConfigurations:
          '[/**]':
            allowedOrigins: 'http://localhost:4200'
            allowedHeaders:
              - Content-Type
            allowedMethods:
              - GET
              - POST
              - PUT
              - DELETE

Would you min helping here: https://stackoverflow.com/questions/73357127/spring-cloud-apigw-spring-boot-and-openapi-issue-cors-issue — PAA, Aug 15 '22 at 06:31

Sakthi · Answer 5 · 2022-10-12T13:23:34.160

The blow solution is worked for me. As we are routing through gateway we need to configure CROS in yaml or properties file.

<div>
spring:
  cloud:
    gateway:
      default-filters:
      - DedupeResponseHeader=Access-Control-Allow-Credentials Access-Control-Allow-Origin
      globalcors:
        cors-configurations:
          '[/**]':
           allowedOrigins: "*"
           allowedMethods: "*"
           allowedHeaders: "*"

score 0 · Answer 6 · edited Jan 12 '23 at 09:59

@Bean
public CorsFilter corsFilter() {
  final UrlBasedCorsConfigurationSource source=new UrlBasedCorsConfigurationSource();
  final CorsConfiguration config=new CorsConfiguration();
  config.setAllowCredentials(true);
  config.addAllowedHeader("*");
  config.addAllowedOriginPattern("*");
  config.addAllowedMethod("OPTIONS");
  config.addAllowedMethod("POST");
  config.addAllowedMethod("GET");
  config.addAllowedMethod("PUT");
  config.addAllowedMethod("DELETE");
  source.registerCorsConfiguration("/**", config);
  return new CorsFilter(source);
}

score -1 · Answer 7 · answered May 26 '21 at 09:11

-1

maybe you need to set "allowCredentials"

spring:
  cloud:
    gateway:
      globalcors:
        corsConfigurations:
          '[/**]':
            allowedOrigins: "https://example.com"
            allowCredentials: true
            allowedMethods:
            - GET
            - POST

answered May 26 '21 at 09:11

hdsuperman

182
2
6

Strangely not working for me – PAA Dec 08 '21 at 07:47

max · Answer 8 · 2021-01-14T09:11:55.683

-5

That problem appears when you add yml file then pom.xml file will be red, You have to delete m2/repository and build your project again, After that pom.xml is normal and the problem will be solved.

edited Jan 14 '21 at 09:11

answered Jan 09 '21 at 11:35

max

1
1

Spring Gateway Request blocked by CORS (No Acces0Control-Allow-Orgin header)

8 Answers8

Linked