Details
-
Bug
-
Status: Closed (View Workflow)
-
P2
-
Resolution: Done
-
3.1.2
-
CP: sprint 92, CP: sprint 110, CP: sprint 111, CP: sprint 112
-
5
-
Core: Platform
-
R2 2021
Description
Overview:
The way that CORS delegation was implemented, the CorsHandler is sometimes called multiple times. For most requests this is fine (albeit inefficient). However, the vertx CorsHandlerImpl sends a response if handling an OPTIONS request instead of calling routingContext.next(). The result is that the first time the default handler is called, the request only has CHECK_DELEGATE_CORS set, and since the check has not yet happened, CORS is handled by OKAPI and the response is set, even in cases when delegateCORS=true.
Steps to Reproduce:
- Set a handler so that delegateCORS=true
- Register/Enable the module descriptor
- make a preflight request to that endpoint via the /_/invoke/tenant/<tid>/path API
- Observe via X-Okapi-Trace that the request was never proxied to the module, but rather CORS was handled by OKAPI.
Expected Results:
The OPTIONS request is proxied to the module
Actual Results:
OKAPI handles CORS
Additional Information:
Interested parties:
hji
TestRail: Results
Attachments
Issue Links
- blocks
-
MODLOGSAML-58 Arbitrary URL Redirection in SAML Response
-
- Closed
-
-
MODLOGSAML-59 Umbrella: Cross-Site Request Forgery (CSRF) in SSO Flow
-
- Closed
-
-
MODLOGSAML-63 Implement CSRF Prevention
-
- Closed
-
- relates to
-
OKAPI-1016 Support delegate preflight request
-
- Closed
-