Fix missing CORS headers if response has 404 status #3206
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: tim.quinn@oracle.com <tim.quinn@oracle.com>
…o govern all of CORS; it used to not control CORS behavior for JAX-RS annotated endpoints
…ased on the actual request rather than wildcards
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #3188
Overview
Some code had been added a while ago to the CORS logic to explicitly avoid setting CORS headers for 404 responses. This PR removes that code.
An earlier unrelated change in Helidon's Jersey support was suppressing headers added to a response if the status was 404. This PR removes that header suppression.
Two very slight behavioral changes
These are both truly bug fixes.
ResponseWriterdetected a response with status 404 and no content, it would ignore any headers already set and immediately delegate to the next handler in the chain (if any). With these changes, any headers previously set on theContainerResponseare always copied to theServerResponse.cars.enabledconfig key was set tofalse, CORS processing would still occur for JAX-RS endpoints (as indicated by JAX-RS annotations). This PR includes changes so that config setting controls JAX-RS CORS behavior as well.Details of changes
webserver/jerseyResponseWriter#writeReponseStatusAndHeaders- An earlier change deferred the transmission of the response to a later handler if the response status is 404 and the content length is 0. Change to return response (not defer) if there are any headers. This handles the case where CORS is in play and has added headers to the response even for the 404 case.webserver/corsCorsSupportHelper#prepareResponse- If response is 404, return valid CORS headers tailored to the (failed) request instead of suppressing CORS headers.CrossOriginConfig- add constant used for catch-all headers in 404 responsesSigned-off-by: tim.quinn@oracle.com tim.quinn@oracle.com