Skip to content

Ignore trailing slash in CorsConfiguration origin patterns #26892

@korektur

Description

@korektur

Affects: v5.3.6


It's connected to #24763 - CorsConfiguration based on pattern matching.
While feature itself works really well, I found few corner cases where it's difficult to configure such patterns because of limitations that current pattern syntax provides.

  1. Sometimes origin contains a trailing slash. I think https://*.company.domain should match both https://test.company.domain and https://test.company.domain/. One workaround would be to add two different patterns, one with trailing slash and one without.
  2. Origins could contain port numbers. Currently it's impossible to support generic port with current syntax. As https://*.company.domain* could match https://test.company.domain:80 as well as https://test.company.domain.some.other.domain which is not what intended. Workaround here can be also creating two origins patterns: https://*.company.domain and https://*.company.domain:*.
  3. Would be nice to have possibility to support both http and https in a single pattern.

While there are workarounds as mentioned before, I think this should be supported out of the box (at least 1 & 2). What's more if you want to support 1 & 2 right now you would effectively either would need to create 4 different patterns or if you know how this is working inside spring you would end up with following pattern in your configuration: https://*.company.domain\\E\(:\\d+)?/?\\Q. Which is probably not the best approach either.

I see two possible solutions:

  1. When doing pattern matching against request origin remove trailing slash and port from it and do pattern matching just on host or schema+host
  2. Extend existing pattern syntax, so that it allows to configure patterns with generic port and optional trailing slash.

Metadata

Metadata

Assignees

Labels

in: webIssues in web modules (web, webmvc, webflux, websocket)type: enhancementA general enhancement

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions