CORS + API Auth breaks

[ironhacker]

I downloaded and compiled main to get the new CORS support and it works OK until I enable API Auth. Either setting works on its own, but both combined fail with a 401 Unauthorized on the preflight request. If I make the same GET request from Postman (no preflight) with API Key it's good.

export ENABLE_AUTH=true
export AUTH_DATA_SOURCE=file://auth.yaml (abbreviated here)
export AUTH_PROVIDER=apiKey (this seems required now - defaults to basic auth)

CORS + ENABLE_AUTH=false (this works fine)

CORS + ENABLE_AUTH=true (works in Postman, but fails in Browser with 401 in preflight)

My auth file looks like this. Aside: this seems confusing. Turning on auth should secure all endpoints by default. I have no idea what's leaking.

name: db2rest-security

resourceRoles:
  - resource: "/v1/rdbms/db/**"
    method: get
    roles:
      - admin
  - resource: "/v1/rdbms/db/**"
    method: post
    roles:
      - admin

apiKeys:
  - key: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
    roles: [admin]
    active: true

Do I have a configuration issue? FYI I tried adding options explicitly - didn't help.

[kdhrubo]

There are some issues with auth #848

You will hear back from us soon.

[kdhrubo]

@ironhacker able to replicate with a simple vue app

[kdhrubo]

The pre-flight request is getting blocked by Auth filter.
The CORS problem has to be solved by configuring the CORSFilter with a higher priority than the auth filter @AmeyaKulkarni2001

[AmeyaKulkarni2001]

Hi,
i understand, let me look into this

[kdhrubo]

Solution outline

1. Use CORS Filter - https://docs.spring.io/spring-framework/reference/web/webmvc-cors.html#mvc-cors-filter
2. Javadoc - https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/filter/CorsFilter.html
3. Ensure this filter is only created if CORS is enabled (new parameter).
4. This filter should have higher priority than Auth filter.
5. The configuration should look like this:

cors:
  enabled : true
  mappings: 
     - mapping: /actor/**
       allowedOrigin: http://localhost:3000 # this should not be *
       allowedHeader: *
       allowedMethod: *
    .... more mappings