Set CORS policy for web socket connection using Ocelot

Viewed 691

I have implemented an API-gateway using ocelot in .net core. The gateway redirects all the APIs including a web socket connection.

Sample ocelot json showing redirect of web socket.

{
            "DownstreamPathTemplate": "/notification/{url}",
            "DownstreamScheme": "ws",
            "DownstreamHostAndPorts": [
                {
                    "Host": "localhost",
                    "Port": "8082"
                }
            ],
            "UpstreamPathTemplate": "/notification/{url}",
            "Key": "",
            "UpstreamHttpMethod": [ "Get", "Post", "Options" ],
            "Priority": 0


}

I also have a CORS policy which basically allows all origins.

services.AddCors(o =>
            {
                o.AddDefaultPolicy(p =>
                {
                    p.AllowAnyOrigin()
                    .AllowAnyMethod()
                    .AllowAnyHeader();
                });
            });

The challenge here is that web socket/signalR connection mandatorily requires to allow only particular origins not all. This works if I do like this.

services.AddCors(o =>
            {
                o.AddDefaultPolicy(p =>
                {
                    p.WithOrigins("http://localhost:4200")
                    .AllowAnyMethod()
                    .AllowAnyHeader()
                    .AllowCredentials();
                });
            });

but I don't want to make it a default policy. I just want additional policy which is only for signalR and I similar code can be done to achieve a separate policy.

services.AddCors(o =>
            {
                o.AddDefaultPolicy(p =>
                {
                    p.AllowAnyOrigin()
                    .AllowAnyMethod()
                    .AllowAnyHeader();
                });

                o.AddPolicy("customPolicy", p =>
                {
                    p.WithOrigins("http://localhost:4200")
                    .AllowAnyMethod()
                    .AllowAnyHeader()
                    .AllowCredentials();
                });
            });

This adds a default policy and one named policy but how do I tell my websocket/signalR connection to use the named policy not the default policy?

This is my Configure method.

public async void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            app.UseCors();

            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseAuthentication();
            app.UseWebSockets();
            await app.UseOcelot().ConfigureAwait(false);
        }

So I need suggestions for associating this custom policy to only the web socket connection. In a nutshell, below is my requirement.

SignalR => Named policy (to allow particular origins)

Http => Default policy ( to allow all origins as of now)

The requirement is to enable web sockets only for particular domains whereas Http can be made open for all the domains. So I am looking for suggestions to achieve this requirement.

1 Answers

Try to use just a named policy instead of the default one. Sometimes it works for both cases:


  services.AddCors(o => o.AddPolicy("AllowAnyOrigins", builder =>
            {
               builder.AllowAnyOrigin()
                .AllowAnyHeader()
                .AllowAnyMethod();
        }));


......
......

app.UseCors("AllowAnyOrigins");
Related