[ISSUE #13951] Add configurable CORS filter for console module #13966
Conversation
- Add ConsoleCorsConfig class for managing CORS configurations - Update ConsoleWebConfig to use configurable CORS settings - Add configuration properties in application.properties - Add unit tests for ConsoleCorsConfig and ConsoleWebConfig - Maintain backward compatibility with default settings
|
Thanks for your this PR. 🙏 感谢您提交的PR。 🙏 |
|
|
| * | ||
| * @author zhan7236 | ||
| */ | ||
| public class ConsoleCorsConfig extends AbstractDynamicConfig { |
There was a problem hiding this comment.
Is need use dynmaic config to set?
I think this config only load in start up phase. Even change value during running, the CorsFilter will not read and effect new config value.
There was a problem hiding this comment.
Agreed. Since the filter initializes only once, dynamic updates won't work anyway. I've removed AbstractDynamicConfig and simplified it to a plain POJO. I will push the updated code shortly.
|
|
4 participants
Please do not create a Pull Request without creating an issue first.
What is the purpose of the change
Add configurable CORS filter support for Nacos console module to allow administrators to customize CORS settings through configuration files, addressing security concerns where unrestricted CORS is considered a high-risk vulnerability in security scan reports.
Brief changelog
ConsoleCorsConfigclass for managing CORS configurations (extendsAbstractDynamicConfig)ConsoleWebConfig.corsFilter()to use configurable CORS settingsapplication.properties:nacos.console.cors.allow-credentials(default: true)nacos.console.cors.allowed-headers(default: allow all)nacos.console.cors.max-age(default: 18000)nacos.console.cors.allowed-methods(default: allow all)nacos.console.cors.allowed-origins(default: allow all)ConsoleCorsConfigandConsoleWebConfigVerifying this change
ConsoleCorsConfigTestwith 3 test cases covering default and custom configurationscorsFilterWithCustomConfiguration()inConsoleWebConfigTestFollow this checklist to help us incorporate your contribution quickly and easily:
[ISSUE #123] Fix UnknownException when host config not exist. Each commit in the pull request should have a meaningful subject line and body.mvn -B clean package apache-rat:check findbugs:findbugs -Dmaven.test.skip=trueto make sure basic checks pass. Runmvn clean install -DskipITsto make sure unit-test pass. Runmvn clean test-compile failsafe:integration-testto make sure integration-test pass. (Will be verified by CI)