Skip to content

fix(hubble): cache CORS preflight responses #750

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cragkhit wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(hubble): cache CORS preflight responses #750

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/config/GlobalCorsConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ public CorsFilter corsFilter() {
config.setAllowCredentials(false);
config.addAllowedMethod("*");
config.addAllowedHeader("*");
config.setMaxAge(3600L);

@imbajin imbajin Aug 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

‼️ Critical: the configured preflight cache is unreachable. This CorsConfiguration never sets allowedOrigins; in the pinned Spring Web 5.1.9, checkOrigin() returns null for an empty origin list and DefaultCorsProcessor rejects the preflight before it reaches the branch that writes Access-Control-Max-Age. Same-origin requests do not need CORS preflight processing, so this line cannot implement the PR's stated behavior. Please either remove this ineffective setting while Hubble remains same-origin-only, or first add an explicit trusted-origin configuration and an OPTIONS regression test proving that an allowed origin receives Access-Control-Max-Age: 3600 while untrusted origins remain rejected.


UrlBasedCorsConfigurationSource source =
new UrlBasedCorsConfigurationSource();
Expand Down
Loading