Mailing-List: contact issues-help@camel.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@camel.apache.org
Date: Fri, 10 Mar 2017 10:23:04 +0000 (UTC)
From: "Claus Ibsen (JIRA)" <jira@apache.org>
To: issues@camel.apache.org
Message-ID: <JIRA.13047276.1488365314000.1463.1489141384352@Atlassian.JIRA>
In-Reply-To: <JIRA.13047276.1488365314000@Atlassian.JIRA>
References: <JIRA.13047276.1488365314000@Atlassian.JIRA> <JIRA.13047276.1488365314160@jira-lw-us.apache.org>
Subject: [jira] [Commented] (CAMEL-10913) CORS header
 Access-Control-Allow-Credentials not managed correctly
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 10 Mar 2017 10:23:12 -0000


    [ https://issues.apache.org/jira/browse/CAMEL-10913?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15904851#comment-15904851 ] 

Claus Ibsen commented on CAMEL-10913:
-------------------------------------

Yeah so if that corsAllowCredentials = true then we set the origin to be Origin instead of * (if its a *)

> CORS header Access-Control-Allow-Credentials not managed correctly
> ------------------------------------------------------------------
>
>                 Key: CAMEL-10913
>                 URL: https://issues.apache.org/jira/browse/CAMEL-10913
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-http-common
>            Reporter: Nicola Ferraro
>             Fix For: 2.19.0
>
>
> When a browser uses the "withCredentials" flag (not visible in HTTP request headers), it accepts the response only if the "Access-Control-Allow-Credentials" header returned by the server is set to "true".
> That header is not part of Camel standard cors headers, but it can be set in the route. The problem is that when "Access-Control-Allow-Credentials" is set to "true", the "Access-Control-Allow-Origin" header cannot be set to "*", which is our default (https://www.w3.org/TR/cors/ - section 6.1, point 3).
> Setting a value for the "Access-Control-Allow-Origin" header equals to the "Origin" header of the request makes the trick, but this must be set per-route, and *CORS must be disabled*.
> Eg. 
> {code}
> // do not enable cors
> rest().get("/hello")
>   .route()
>   .to("direct:handle")
>   .setHeader("Access-Control-Allow-Credentials", constant("true"))
>   .setHeader("Access-Control-Allow-Origin", header("Origin"));
> {code}
> Otherwise the only option is setting a fixed allowed origin if you know it in advance.
> I wonder if we should add e.g. a ".corsAllowCredentials(boolean)" configuration to handle this situation correctly, or another flag to reflect the origin instead of returning "*".


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)