I have implemented an API-gateway using ocelot in .net core. The gateway redirects all the APIs including a web socket connection.
Sample ocelot json showing redirect of web socket.
{
"DownstreamPathTemplate": "/notification/{url}",
"DownstreamScheme": "ws",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": "8082"
}
],
"UpstreamPathTemplate": "/notification/{url}",
"Key": "",
"UpstreamHttpMethod": [ "Get", "Post", "Options" ],
"Priority": 0
}
I also have a CORS policy which basically allows all origins.
services.AddCors(o =>
{
o.AddDefaultPolicy(p =>
{
p.AllowAnyOrigin()
.AllowAnyMethod()
.AllowAnyHeader();
});
});
The challenge here is that web socket/signalR connection mandatorily requires to allow only particular origins not all. This works if I do like this.
services.AddCors(o =>
{
o.AddDefaultPolicy(p =>
{
p.WithOrigins("http://localhost:4200")
.AllowAnyMethod()
.AllowAnyHeader()
.AllowCredentials();
});
});
but I don't want to make it a default policy. I just want additional policy which is only for signalR and I similar code can be done to achieve a separate policy.
services.AddCors(o =>
{
o.AddDefaultPolicy(p =>
{
p.AllowAnyOrigin()
.AllowAnyMethod()
.AllowAnyHeader();
});
o.AddPolicy("customPolicy", p =>
{
p.WithOrigins("http://localhost:4200")
.AllowAnyMethod()
.AllowAnyHeader()
.AllowCredentials();
});
});
This adds a default policy and one named policy but how do I tell my websocket/signalR connection to use the named policy not the default policy?
This is my Configure method.
public async void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
app.UseCors();
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
app.UseAuthentication();
app.UseWebSockets();
await app.UseOcelot().ConfigureAwait(false);
}
So I need suggestions for associating this custom policy to only the web socket connection. In a nutshell, below is my requirement.
SignalR => Named policy (to allow particular origins)
Http => Default policy ( to allow all origins as of now)
The requirement is to enable web sockets only for particular domains whereas Http can be made open for all the domains. So I am looking for suggestions to achieve this requirement.