Support for CORS headers

[vroudge]

Hello!

I'm trying to use this to test a browser-based uploader. I get issues related to CORS. Is there anyway to set the cross origin headers with S3Mock ?

[agudian]

We don’t have that, yet. But I bet it can be added through Spring Boot...

[vroudge]

That would be brilliant. I'm not a Java person myself, but I'll keep looking at this ticket, it's a very interesting feature.

[timoe]

@vroudge: Spring (Boot) offers CORS configuration (see: https://spring.io/blog/2015/06/08/cors-support-in-spring-framework). The most simple way to enable each and every origin would be to add a global mapping for each and every API S3Mock provides.

My current idea is to enabled origins and/or API endpoints via configuration. Before doing that, can give please give the usecase you're working on? Do you have any examples, code-snippets that let me verify this for your usecase?

Thanks
Timo

[afranken]

version 2.2.2 adds CORS headers for all origins (wildcard pattern).
Hope that helps.

[mikemonteith]

This change results in two identical Access-Control-Allow-Origin: * headers being set on the GET controller, which gives a browser error "Cross-Origin Request Blocked: .... (Reason: Multiple CORS header ‘Access-Control-Allow-Origin’ not allowed)."

There was already a cross origin http header being set here

S3Mock/server/src/main/java/com/adobe/testing/s3mock/FileStoreController.java

Line 608 in afbce43

.header(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, ANY)

I think the @CrossOrigin annotation is the correct way to do it, I will open a PR to remove the extra ACCESS_CONTROL_ALLOW_ORIGIN header unless someone else beats me to it.

[afranken]

@mikemonteith thx for alerting me - I'll remove the explicit setting you mentioned, just opened a PR :)

[mikemonteith]

Wow @afranken that was fast!

[afranken]

@mikemonteith thanks for providing the solution with the report :)

I was just merging the latest dependabot updates and then release, so it was easy to add in this trivial fix.
We unfortunately do not have any browser-related tests, and I was too lazy to manually test if the CORS headers are actually working. Maybe I'll add asserts to one of the integration tests when I find the time...