CORS Configuration Questions

[bakert-96]

Hi team, have a question regarding CORS configuration.

Is there a way to specify allowed origin patterns currently or any plans to support it in the future? We did find an open issue/PR for this but it hasn't had any movement in the past few months.

We have many subdomains and want to configure multiple origin patterns like https://*.example.com and https://*.example.com:[*]. We tried using CorsService's builder(String...origins) and the CorsDecorator annotation's origins but looks to only allow exact matches.

Thank you!

[ikhoon]

Thank you for sharing about the usage. We will review the PR more actively and make sure it progresses quickly.

[bakert-96]

Awesome, thanks for the response! So, is there any recommended way we can achieve this currently?

For some background, we've been migrating to Armeria in a process very similar to this: https://www.slideshare.net/slideshow/hello-armeria-bye-spring/251604421
We have been running our app similarly to the must-have migration step for a while now and have been using Spring for configuring CORS. Now, we are working on the final goal of Armeria only and Spring for DI.

[minwoox]

Hi! I think we can do this by:

• Allowing any origin using CorsService.builderForAnyOrigin()
• Add a decorator before CorsService that checks the origin using regex.

ref:

armeria/core/src/main/java/com/linecorp/armeria/server/cors/CorsService.java

Line 58 in 871d872

public static CorsServiceBuilder builderForAnyOrigin() {

[bakert-96]

This worked perfectly, thank you for the response/guidance! I also saw the PR was getting reviewed. You all are awesome!

[minwoox]

@bakert-96 Additionally, which origin do you anticipate being specified in the Access-Control-Allow-Origin header? Furthermore, could you provide an example of how to create servers with subdomains?

[ikhoon]

I've checked that Spring returns the requested Origin header value as is if the origin is matched by a pattern.
https://github.com/spring-projects/spring-framework/blob/3854861a8a71da97a8275c76ea81ad04025da9ae/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java#L632

[minwoox]

Thanks for the link! I think we can use the same approach here. 👍