quarkus.http.cors.origins=* should be supported #5422

Postremus · 2019-11-12T21:28:03Z

Describe the bug
When I read the documentation about configuring cors for the first time, I tought that leaving "quarkus.http.cors.origins" as empty would be the same as "Access-Control-Allow-Origin: *".
The * wildcard allows any origin to access ressources.

Furthermore, a value of "*" is currently not supported. See CORSFilter.java#L93.
boolean allowsOrigin = corsConfig.origins.isEmpty() || corsConfig.origins.contains(origin);

We should try to improve the documentation to reflect what is actually going on in the filter.

Expected behavior

For requests without credentials, the literal value "*" can be specified, as a wildcard; the value tells browsers to allow requesting code from any origin to access the resource.

If I use "" as wildcard, I expect quarkus to allow any origin to access my resources.
If I remove "quarkus.http.cors.origins" in my configuration, I expect quarkus to use "" as default.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

Actual behavior
Requests get rejected, altough quarkus.http.cors.origins is set to "*".

Configuration

uarkus.http.cors=true
quarkus.http.cors.origins=*

Environment (please complete the following information):

Output of uname -a or ver:
SYS_NT-10.0 DESKTOP-0TKUM9I 2.11.2(0.329/5/3) 2018-11-10 14:38 x86_64 Msys
Output of java -version:
java version "1.8.0_211"
Java(TM) SE Runtime Environment (build 1.8.0_211-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.211-b12, mixed mode)
Quarkus version or git rev: 1.0.0.CR1

sberyozkin · 2019-11-12T22:45:51Z

@Postremus so what happens when you do not set the origins property at all ?

Postremus · 2019-11-13T07:28:24Z

@sberyozkin When I do not set the origins property at all, I can access my resources from any origin.
Other cors settings, like the list of allowed headers, still get applied.

This is also the behavior I would expect from setting origin to "*".

sberyozkin · 2019-11-13T10:46:24Z

@Postremus I'm not sure why it was not supported from the start but it is really not a bug, and it is documented that leaving this property is equivalent to supporting all the origins which also implies less configuration.
However, some users have also tried to set it to a wildcard before so it appears it would help if that boolean check were extended to check a *.
Would you like to do a small PR ? It should not take much time.

Postremus · 2019-11-13T11:25:52Z

@sberyozkin I will try to create one this evening (CET).


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Also, fix documentation. All configuration values are optional. The default of the origins config property is now "*". Tests are also updated. For example, no whitespace is allowed in quarkus.http.cors.methods. No string.trim() is done on this list, and it is directly passed to the enum method HttpMethods.valueOf(). fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Tests are also updated. For example, no whitespace is allowed in quarkus.http.cors.methods. No string.trim() is done on this list, and it is directly passed to the enum method HttpMethods.valueOf(). fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Fix naming of one of the test classes. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Fix naming of one of the test classes. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        The star wildcard for the origins means, that any origin can access t…

…he service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422


        Support * Wildcard for quarkus.http.cors.origins

The star wildcard for the origins means, that any origin can access the service. Previosly, this behavior could only be achieved by leaving the config property out completly. Now you can either not set the origins config property, or use "*". Adjust the documentation for * origins. Add test case for this. fixes quarkusio#5422

Postremus added the kind/bug label Nov 12, 2019

Postremus changed the title ~~cors.origins=* is not supported~~ quarkus.http.cors.origins=* is not supported Nov 12, 2019

sberyozkin added area/security kind/enhancement and removed kind/bug labels Nov 13, 2019

sberyozkin changed the title ~~quarkus.http.cors.origins=* is not supported~~ quarkus.http.cors.origins=* should be supported Nov 13, 2019

gastaldi added the good first issue label Nov 13, 2019

Postremus linked a pull request that will close this issue Nov 13, 2019

Support * Wildcard for quarkus.http.cors.origins #5455

Open

quarkusio / quarkus

quarkus.http.cors.origins=* should be supported #5422

quarkus.http.cors.origins=* should be supported #5422

Postremus commented Nov 12, 2019

This comment has been minimized.

sberyozkin commented Nov 12, 2019

This comment has been minimized.

Postremus commented Nov 13, 2019

This comment has been minimized.

sberyozkin commented Nov 13, 2019 •

edited

This comment has been minimized.

Postremus commented Nov 13, 2019

quarkusio / quarkus

Join GitHub today

quarkus.http.cors.origins=* should be supported #5422

quarkus.http.cors.origins=* should be supported #5422

Comments

Postremus commented Nov 12, 2019

This comment has been minimized.

sberyozkin commented Nov 12, 2019

This comment has been minimized.

Postremus commented Nov 13, 2019

This comment has been minimized.

sberyozkin commented Nov 13, 2019 • edited

This comment has been minimized.

Postremus commented Nov 13, 2019

sberyozkin commented Nov 13, 2019 •

edited