Make CORS headers configurable

[deliahu]

Description

Option 1:

kind: api
name: my-api
...
enable_cors: true

Option 2:

kind: api
name: my-api
...
cors:
    Access-Control-Allow-Origin: <string>
    Access-Control-Allow-Headers: <string>

[wise-east]

How can we configure CORS for the current version? I see #539 is closed.

[deliahu]

Tagging @vishalbollu who has spent the most time on CORS. I believe @wise-east is running v0.14 (please correct me if I'm wrong)

[wise-east]

@deliahu Yes, I'm using v0.14 for now. Thank you.

[vishalbollu]

@wise-east Issue #539 was addressed by returning a blanket

Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: * # can be configured if request sends Access-Control-Request-Headers 

The ability to specify custom CORS headers as described in this ticket hasn't been implemented yet. Do you think returning responses with the headers above will satisfy your current requirements in the meantime?

Thanks for bringing this up. I just looked through our serving code and I think I found a bug in Cortex versions >= 0.14.0 that prevents the server from handling CORS correctly. Specifically, I don't think the server responds correctly to OPTIONS requests. We will investigate this issue more thoroughly.

[wise-east]

Forgive my ignorance, I'm not sure what you mean by addressed by returning a blanket. Can you elaborate?

If the problem is with versions >=0.14.0, and if I want to be able to handle CORS now, is it possible to do so by using a previous version (<0.14.0)? If so, can a newly installed cortex pick up the cluster I have set up with the current installation of cortex after I uninstall my current installation? Or will I have to do cortex cluster down and then uninstall and reinstall and do cortex cluster up again? I hope that since my AWS credentials will be the same that I won't have to do this and be able to use a previous version.

[vishalbollu]

@wise-east Apologies, what I meant by addressed by returning a blanket was that the CORS that we had in <0.14.0 returned "*" or equivalent for CORS headers like Access-Control-Allow-Origin and Access-Control-Allow-Headers.

You should be able to get it working with Cortex version <0.14.0. If it is not too urgent, I would recommend waiting because we are looking to release 0.15.1 that should address the CORS issue and a CLI bug fix either today or tomorrow.

cortex cluster down, install cortex CLI with your desired version and cortex cluster up is the safest upgrade path at the moment because mismatched versions may cause compatibility issues.

[wise-east]

I see. I was actually able to bypass the issues for now with the guide provided to me at https://www.cortex.dev/v/master/guides/api-gateway by @deliahu

[deliahu]

@wise-east sounds good!

We just release v0.15.1 in case you want to upgrade, just letting you know

[deliahu]

Closing since this is now supported