Skip to content

Commit be3033f

Browse files
tranHoang-PhuctranHoang-Phuc
committed
fix: cors
1 parent 63fbc3b commit be3033f

2 files changed

Lines changed: 246 additions & 9 deletions

File tree

‎.idea/workspace.xml‎

Lines changed: 13 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎nginx/templates/default.conf.template‎

Lines changed: 233 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,8 @@ server {
7777
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,Upgrade,Connection,Sec-WebSocket-Key,Sec-WebSocket-Version,Sec-WebSocket-Protocol' always;
7878
}
7979

80-
# Special configuration for SSE endpoints
81-
location /api/v1/notification/sse/ {
80+
# Special configuration for SSE endpoints - more specific path matching
81+
location ~ ^/api/v1/notification/sse/stream/ {
8282
proxy_pass http://api-gateway:9191;
8383
proxy_set_header Host $host;
8484
proxy_set_header X-Real-IP $remote_addr;
@@ -93,6 +93,7 @@ server {
9393
proxy_buffering off;
9494
proxy_read_timeout 86400s;
9595
proxy_send_timeout 86400s;
96+
proxy_request_buffering off;
9697

9798
# Disable gzip for SSE
9899
gzip off;
@@ -105,25 +106,102 @@ server {
105106
proxy_hide_header 'Access-Control-Allow-Credentials';
106107

107108
# Add CORS headers for SSE with specific origin handling
108-
# Set the allowed origin based on the request origin
109109
set $cors_origin "*";
110-
111-
# For requests with Origin header, use the actual origin for credential support
112110
if ($http_origin != "") {
113111
set $cors_origin $http_origin;
114112
}
115113

116114
add_header 'Access-Control-Allow-Origin' $cors_origin always;
117115
add_header 'Access-Control-Allow-Credentials' 'true' always;
118-
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
116+
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
119117
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
120118
add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
121119

120+
# Handle preflight requests for SSE
121+
if ($request_method = 'OPTIONS') {
122+
add_header 'Access-Control-Allow-Origin' $cors_origin;
123+
add_header 'Access-Control-Allow-Credentials' 'true';
124+
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
125+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
126+
add_header 'Access-Control-Max-Age' 1728000;
127+
add_header 'Content-Type' 'text/plain; charset=utf-8';
128+
add_header 'Content-Length' 0;
129+
return 204;
130+
}
131+
}
132+
133+
# Specific configuration for reading endpoints
134+
location /api/v1/reading/ {
135+
proxy_pass http://api-gateway:9191;
136+
proxy_set_header Host $host;
137+
proxy_set_header X-Real-IP $remote_addr;
138+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
139+
proxy_set_header X-Forwarded-Proto $scheme;
140+
proxy_set_header Origin $http_origin;
141+
142+
# Hide CORS headers from backend to prevent duplicates
143+
proxy_hide_header 'Access-Control-Allow-Origin';
144+
proxy_hide_header 'Access-Control-Allow-Methods';
145+
proxy_hide_header 'Access-Control-Allow-Headers';
146+
proxy_hide_header 'Access-Control-Expose-Headers';
147+
proxy_hide_header 'Access-Control-Allow-Credentials';
148+
149+
# Standard CORS for reading API
150+
set $cors_origin "*";
151+
if ($http_origin != "") {
152+
set $cors_origin $http_origin;
153+
}
154+
155+
add_header 'Access-Control-Allow-Origin' $cors_origin always;
156+
add_header 'Access-Control-Allow-Credentials' 'true' always;
157+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
158+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
159+
160+
# Handle preflight requests
161+
if ($request_method = 'OPTIONS') {
162+
add_header 'Access-Control-Allow-Origin' $cors_origin;
163+
add_header 'Access-Control-Allow-Credentials' 'true';
164+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
165+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
166+
add_header 'Access-Control-Max-Age' 1728000;
167+
add_header 'Content-Type' 'text/plain; charset=utf-8';
168+
add_header 'Content-Length' 0;
169+
return 204;
170+
}
171+
}
172+
173+
# Specific configuration for listening endpoints
174+
location /api/v1/listening/ {
175+
proxy_pass http://api-gateway:9191;
176+
proxy_set_header Host $host;
177+
proxy_set_header X-Real-IP $remote_addr;
178+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
179+
proxy_set_header X-Forwarded-Proto $scheme;
180+
proxy_set_header Origin $http_origin;
181+
182+
# Hide CORS headers from backend to prevent duplicates
183+
proxy_hide_header 'Access-Control-Allow-Origin';
184+
proxy_hide_header 'Access-Control-Allow-Methods';
185+
proxy_hide_header 'Access-Control-Allow-Headers';
186+
proxy_hide_header 'Access-Control-Expose-Headers';
187+
proxy_hide_header 'Access-Control-Allow-Credentials';
188+
189+
# Standard CORS for listening API
190+
set $cors_origin "*";
191+
if ($http_origin != "") {
192+
set $cors_origin $http_origin;
193+
}
194+
195+
add_header 'Access-Control-Allow-Origin' $cors_origin always;
196+
add_header 'Access-Control-Allow-Credentials' 'true' always;
197+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
198+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
199+
122200
# Handle preflight requests
123201
if ($request_method = 'OPTIONS') {
124202
add_header 'Access-Control-Allow-Origin' $cors_origin;
125203
add_header 'Access-Control-Allow-Credentials' 'true';
126-
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
204+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
127205
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
128206
add_header 'Access-Control-Max-Age' 1728000;
129207
add_header 'Content-Type' 'text/plain; charset=utf-8';
@@ -132,6 +210,154 @@ server {
132210
}
133211
}
134212

213+
# Specific configuration for identity endpoints
214+
location /api/v1/identity/ {
215+
proxy_pass http://api-gateway:9191;
216+
proxy_set_header Host $host;
217+
proxy_set_header X-Real-IP $remote_addr;
218+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
219+
proxy_set_header X-Forwarded-Proto $scheme;
220+
proxy_set_header Origin $http_origin;
221+
222+
# Hide CORS headers from backend to prevent duplicates
223+
proxy_hide_header 'Access-Control-Allow-Origin';
224+
proxy_hide_header 'Access-Control-Allow-Methods';
225+
proxy_hide_header 'Access-Control-Allow-Headers';
226+
proxy_hide_header 'Access-Control-Expose-Headers';
227+
proxy_hide_header 'Access-Control-Allow-Credentials';
228+
229+
# Standard CORS for identity API
230+
set $cors_origin "*";
231+
if ($http_origin != "") {
232+
set $cors_origin $http_origin;
233+
}
234+
235+
add_header 'Access-Control-Allow-Origin' $cors_origin always;
236+
add_header 'Access-Control-Allow-Credentials' 'true' always;
237+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
238+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
239+
240+
# Handle preflight requests
241+
if ($request_method = 'OPTIONS') {
242+
add_header 'Access-Control-Allow-Origin' $cors_origin;
243+
add_header 'Access-Control-Allow-Credentials' 'true';
244+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
245+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
246+
add_header 'Access-Control-Max-Age' 1728000;
247+
add_header 'Content-Type' 'text/plain; charset=utf-8';
248+
add_header 'Content-Length' 0;
249+
return 204;
250+
}
251+
}
252+
253+
# Specific configuration for personal endpoints (excluding WebSocket)
254+
location /api/v1/personal/ {
255+
proxy_pass http://api-gateway:9191;
256+
proxy_set_header Host $host;
257+
proxy_set_header X-Real-IP $remote_addr;
258+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
259+
proxy_set_header X-Forwarded-Proto $scheme;
260+
proxy_set_header Origin $http_origin;
261+
262+
# Hide CORS headers from backend to prevent duplicates
263+
proxy_hide_header 'Access-Control-Allow-Origin';
264+
proxy_hide_header 'Access-Control-Allow-Methods';
265+
proxy_hide_header 'Access-Control-Allow-Headers';
266+
proxy_hide_header 'Access-Control-Expose-Headers';
267+
proxy_hide_header 'Access-Control-Allow-Credentials';
268+
269+
# Standard CORS for personal API
270+
set $cors_origin "*";
271+
if ($http_origin != "") {
272+
set $cors_origin $http_origin;
273+
}
274+
275+
add_header 'Access-Control-Allow-Origin' $cors_origin always;
276+
add_header 'Access-Control-Allow-Credentials' 'true' always;
277+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
278+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
279+
280+
# Handle preflight requests
281+
if ($request_method = 'OPTIONS') {
282+
add_header 'Access-Control-Allow-Origin' $cors_origin;
283+
add_header 'Access-Control-Allow-Credentials' 'true';
284+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
285+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
286+
add_header 'Access-Control-Max-Age' 1728000;
287+
add_header 'Content-Type' 'text/plain; charset=utf-8';
288+
add_header 'Content-Length' 0;
289+
return 204;
290+
}
291+
}
292+
293+
# Specific configuration for resource/file endpoints
294+
location /api/v1/resource/ {
295+
proxy_pass http://api-gateway:9191;
296+
proxy_set_header Host $host;
297+
proxy_set_header X-Real-IP $remote_addr;
298+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
299+
proxy_set_header X-Forwarded-Proto $scheme;
300+
proxy_set_header Origin $http_origin;
301+
302+
# Hide CORS headers from backend to prevent duplicates
303+
proxy_hide_header 'Access-Control-Allow-Origin';
304+
proxy_hide_header 'Access-Control-Allow-Methods';
305+
proxy_hide_header 'Access-Control-Allow-Headers';
306+
proxy_hide_header 'Access-Control-Expose-Headers';
307+
proxy_hide_header 'Access-Control-Allow-Credentials';
308+
309+
# Standard CORS for resource API
310+
set $cors_origin "*";
311+
if ($http_origin != "") {
312+
set $cors_origin $http_origin;
313+
}
314+
315+
add_header 'Access-Control-Allow-Origin' $cors_origin always;
316+
add_header 'Access-Control-Allow-Credentials' 'true' always;
317+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
318+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
319+
320+
# Handle preflight requests
321+
if ($request_method = 'OPTIONS') {
322+
add_header 'Access-Control-Allow-Origin' $cors_origin;
323+
add_header 'Access-Control-Allow-Credentials' 'true';
324+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
325+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
326+
add_header 'Access-Control-Max-Age' 1728000;
327+
add_header 'Content-Type' 'text/plain; charset=utf-8';
328+
add_header 'Content-Length' 0;
329+
return 204;
330+
}
331+
}
332+
333+
# Fallback for other notification endpoints (non-SSE)
334+
location /api/v1/notification/ {
335+
proxy_pass http://api-gateway:9191;
336+
proxy_set_header Host $host;
337+
proxy_set_header X-Real-IP $remote_addr;
338+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
339+
proxy_set_header X-Forwarded-Proto $scheme;
340+
proxy_set_header Origin $http_origin;
341+
342+
# Hide CORS headers from backend to prevent duplicates
343+
proxy_hide_header 'Access-Control-Allow-Origin';
344+
proxy_hide_header 'Access-Control-Allow-Methods';
345+
proxy_hide_header 'Access-Control-Allow-Headers';
346+
proxy_hide_header 'Access-Control-Expose-Headers';
347+
proxy_hide_header 'Access-Control-Allow-Credentials';
348+
349+
# Standard CORS for notification API
350+
set $cors_origin "*";
351+
if ($http_origin != "") {
352+
set $cors_origin $http_origin;
353+
}
354+
355+
add_header 'Access-Control-Allow-Origin' $cors_origin always;
356+
add_header 'Access-Control-Allow-Credentials' 'true' always;
357+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
358+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
359+
}
360+
135361
location / {
136362
proxy_set_header Origin $http_origin;
137363
proxy_set_header Host $host;

0 commit comments

Comments
 (0)