CORS policy is blocking due to that getting server not found error

5/26/2020

We have configured the kubernetes environment for our application. Which has one master, two slaves and nginx is using as a webserver. While access the url of our application, getting the cors error. I have followed kubernetes document(https://kubernetes.io/docs/tasks/access-application-cluster/connecting-frontend-backend/) for setting connection between backend and fronend, you can find all those details below. Here am not mentioning the full details of the yamls files and please let know if am missing anything.

This is the error am getting.

Access to XMLHttpRequest at 'http://andy.fin.com:9090/configuration/api/v1/configuration' from origin 'http://172.16.198.102:32603' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
#nginx configuration
upstream zuul {
    server zuul;
}
location / {
    proxy_pass http://andy.fin.com:9090/;
    proxy_redirect off;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto "http";
    proxy_set_header Origin "http://localhost:32603";
    proxy_set_header Referer "http://localhost:32603";
    proxy_hide_header 'Access-Control-Allow-Origin';
  }
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: zuul
      tier: frontend
  replicas: 1 
  template: 
    metadata:
      labels:
        app: zuul
        tier: frontend
    spec:
      containers:
      - name: nginx
        image: nginx

---
apiVersion: v1
kind: Service
metadata:
  name: frontend
spec:
  selector:
    app: zuul
    tier: frontend
  ports:
  - protocol: "TCP"
    port: 80
    targetPort: 80
  type: LoadBalancer
apiVersion: apps/v1
kind: Deployment
metadata:
  name: zuul-routing
spec:
  selector:
     matchLabels:
       app: zuul
       tier: backend
  replicas: 1
  template:
    metadata:
      labels:
        app: zuul
        tier: backend
    spec:
      containers:
      - env:
---
apiVersion: v1
kind: Service
metadata:
  name: zuul
spec:
  selector:
    app: zuul
    tier: backend
  ports:
  - protocol: TCP
    port: 9090
    targetPort: http
-- Andy
kubernetes
kubernetes-ingress
nginx
nginx-reverse-proxy

1 Answer

5/26/2020

New answer:

Basically you need at some point make the following decion:

Is the given Origin allowed to access the requested content?

You can answer that question in the reverse proxy, in the endpoints webserver or in the application's logic. Advanced: Combine those and make decisions in multiple places. Just be careful, not to overwrite previously set headers unintentionally.

Is the answer yes?

Then, the header must be set in a URI style containing:

http[s]://<trusted_origin_domain>[:port] 

From your question, it is not clear, at which point you setup the logic and set the information accordingly.

For simplicity, you could start of by letting nginx send the correct header. It is important not to mix up headers sent to the node, and headers sent to the client.

If you have the CORS implementation in the application, you should pass the parameters (trusted origin) via environment or in a buildstep or in similiar stage.

Chose a way that allows you to scale as much as neccessary, while consuming as little time as possible.

Looking at closer at your specific problem

It seems that your decision making in the application and in nginx are overlapping.

Side note concerning HTTPS

You might be leaking unencrypted http traffic when forwarding through the internet without having further DNS and VPN setup.

Old answer:

The header sent to the browser must look exactly lke this in your case:

Access-Control-Allow-Origin: http://172.16.198.102:32603

As you are overwriting Referer and Origin, the whole security is not working:

proxy_set_header Origin "http://localhost:32603";
proxy_set_header Referer "http://localhost:32603";

Remove those.

You are blocking the concerning CORS header from reaching the browser:

proxy_hide_header 'Access-Control-Allow-Origin';

Remove that as well.

-- Daniel W.
Source: StackOverflow