Request rejected by CORS for fonts in dev UI when quarkus.http.cors=true is set

[gastaldi]

Describe the bug

When quarkus.http.cors=true is set, navigating to the dev UI in http://localhost:8080/q/dev fails while fetching the WOFF fonts with Failed to load resource: the server responded with a status of 403 (CORS Rejected - Invalid origin) in the browser (Chrome) console.

Expected behavior

No errors and the icons are rendered properly in the Dev UI

Actual behavior

The fonts are not rendered and you can see the before mentioned error in the console logs

How to Reproduce?

1. Create a new Quarkus application with quarkus create app
2. Add the quarkus.http.cors=true to the application.properties
3. Run the following cURL command. It should return 200 but returns HTTP/1.1 403 CORS Rejected - Invalid origin instead :

curl 'http://localhost:8080/q/dev/resources/fontawesome/webfonts/fa-solid-900.woff2' \
  -H 'Accept: */*' \
  -H 'Accept-Language: en-US,en;q=0.9,pt-BR;q=0.8,pt;q=0.7' \
  -H 'Connection: keep-alive' \
  -H 'DNT: 1' \
  -H 'Origin: http://localhost:8080' \
  -H 'Referer: http://localhost:8080/q/dev/resources/fontawesome/css/all.min.css' \
  -H 'Sec-Fetch-Dest: font' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-origin' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36' \
  -H 'sec-ch-ua: "Chromium";v="110", "Not A(Brand";v="24", "Google Chrome";v="110"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"' \
  --compressed

Output of uname -a or ver

Darwin MacBook-Pro-de-George 22.3.0 Darwin Kernel Version 22.3.0: Mon Jan 30 20:38:37 PST 2023; root:xnu-8792.81.3~2/RELEASE_ARM64_T6000 arm64

Output of java -version

openjdk version "17.0.6" 2023-01-17 OpenJDK Runtime Environment GraalVM CE 22.3.1 (build 17.0.6+10-jvmci-22.3-b13) OpenJDK 64-Bit Server VM GraalVM CE 22.3.1 (build 17.0.6+10-jvmci-22.3-b13, mixed mode, sharing)

GraalVM version (if different from Java)

No response

Quarkus version or git rev

2.16.3.Final

Build tool (ie. output of mvnw --version or gradlew --version)

Apache Maven 3.8.6 (84538c9988a25aec085021c365c560670ad80f63) Maven home: /Users/ggastald/.sdkman/candidates/maven/current Java version: 17.0.6, vendor: GraalVM Community, runtime: /Users/ggastald/.sdkman/candidates/java/22.3.1.r17-grl Default locale: en_BR, platform encoding: UTF-8 OS name: "mac os x", version: "13.2.1", arch: "aarch64", family: "mac"

Additional information

No response

[gsmet]

@gastaldi do you have the same issue with Dev UI 2?

[gastaldi]

@gsmet I can confirm it happens with Dev UI 2 as well:

[sberyozkin]

Thanks @gastaldi Case of duplicate CORSFilter runnig alongside DevConsoleCORSFilter.

I have to admit I'm not sure how to fix it. DevConsoleCORSFilter is designed to work in devmode. Having another CORSFilter was working before because the wildcard was enabled by default which was exactly what DevConsoleCORSFilter is meant to avoid. Now, in 2.16.3, and main, wildcard out of the box is not supported

[sberyozkin]

Actually, I think I know which PR will fix it

[sberyozkin]

@gastaldi I'm 100% sure #30757 will fix it, can you please retry against that PR ?

[gastaldi]

@sberyozkin sorry to disappoint you, but unfortunately it didn't work :(

[sberyozkin]

@gastaldi oops... Sure, will check tomorrow, thanks for the investigation

[sberyozkin]

I knew I should've said 99% :-)

[maxandersen]

I was about to suggest exactly #30757 too as a way to fix it. could it be sameorigin is not being enabled for both devmode and the real one?

[sberyozkin]

In both cases CORS filter makes the decision, without explicitly enabling CORS as George did what happens is that only DevConsoleCORSFilter is listening but it will delegate to a private CORSFilter instance to finalize. But when CORS is also explicitly enabled, both DevConsoleCORSFilter (with private CORSFilter) and an independent CORSFilter without any extra configuration is enabled and indeed I did expect #30757 to cover this case. But something is interfering, I'll debug first thing tomorrow

[sberyozkin]

I'm testing on #30757 so far, Firefox, Chrome, with quarkus.http.cors=true, all is good:

[sberyozkin]

New dev-ui is also good. Now I'll try without this PR

[sberyozkin]

Right, you use curl, this command works too, I get some font downloaded, curl requested me to add --output <FILE>

[sberyozkin]

I can confirm that on main (without #30757) I get 403 CORS error for this font, and a couple of other resources.

@gastaldi George, can you please retry #30757 ?

[sberyozkin]

Guillaume, Max, would you like to try it too for the extra coverage ? Clement, you mentioned you were seeing these 403, please check #30757 as well

[gastaldi]

@sberyozkin you are 100% correct! 😄 I just tested and I confirm that it works with your changes.

It's weird that it didn't work yesterday, it's possible that I might have made some mistakes while switching between Quarkus versions during the test, sorry for that 😅

[sberyozkin]

Hey @gastaldi Np at all, workspace refresh issues are always happening, thanks for reporting the problem and confirming the fix, cheers