invalid cors request when using spring cloud gateway

Question

I have a spring cloud gateway, it forward to downstream servers, and also I have configured filter it to return the below headers

below are the response headers

access-control-allow-headers: origin, content-type, accept, x-requested-with 
access-control-allow-methods: get, post, put, delete, options
access-control-allow-origin: *
access-control-max-age: 3600
date: sun, 19 jun 2022 11:40:13 gmt
expires: 0
pragma: no-cache
vary: origin
vary: access-control-request-method
vary: access-control-request-headers

Below are the Request headers when request is made from chrome

:authority: web.user.tc.com
:method: post
:path: /server/user/data
:scheme: https
accept: application/json
accept-encoding: gzip, deflate, br
accept-language: en-us,en;q=0.9
cache-control: no-cache
content-length: 1787
content-type: application/json
origin: https://web.user.tc.com
pragma: no-cache
referer: https://web.user.tc.com
sec-ch-ua: " not a;brand";v="99", "chromium";v="102", "google chrome";v="102"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "windows"
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-origin
user-agent: mozilla/5.0 (windows nt 10.0; wow64) applewebkit/537.36 (khtml, like gecko) chrome/102.0.0.0 safari/537.36 ionic/2.16.8

but still, I am getting an Invalid Cors Request on my chrome browser not able to understand which header is missing?

is there a way to debug what exactly is missing

user_2206552 · Answer

The 'Invalid Cors Request' may be returned from you downstream service. This may be because the same 'Origin' header might have got forwarded to downstream service and your downstream service might not have any CORS setting.

To avoid this you can use the RemoveRequestHeader gateway filter of spring cloud gateway to remove the 'Origin' header during routing. If you are using Java API routes then you might need to apply this to each routes otherwise you can set it as a default-filter in your application yaml. There is already a bug where the default-filters do not work for Java API routes - Spring cloud Issue

You can put below configuration in your application.yaml to enable debug logs for spring cloud gateway.

logging:
  level:
    ROOT: DEBUG
    reactor:
      netty: DEBUG
    org:
      springframework:
        security: DEBUG
        cloud:
          gateway: DEBUG
spring:
  cloud:
    gateway:
      httpclient:
        wiretap: true
      httpserver:
        wiretap: true

invalid cors request when using spring cloud gateway

1 Answers