tsunejui commented on issue #7363: URL: https://github.com/apache/rocketmq-dashboard/issues/7363#issuecomment-6436197902
Hit exactly the same thing on 2.1.0, and I'm a bit surprised this hasn't had a response yet — #410 reported the same hard-coded CORS origin back in May and was auto-closed as stale with no maintainer reply. **Root cause (2.1.0):** `SecurityConfig#corsConfigurationSource` hard-codes the allow-list to `http://localhost:3003`; it is not read from any property, so it can't be changed through `application.yml`, env vars or `-D` flags. Behind a reverse proxy the app also sees itself as `http://<host>:80` (the proxy sends `X-Forwarded-Proto: http`), so any browser `Origin` that differs — an HTTPS domain, or a port-forward/tunnel on another port — is rejected with `403 Invalid CORS request` before the credentials are even checked. That plain-text body is what the UI then fails to parse as JSON. **Workaround for Helm / Gateway API deployments:** strip the `Origin` header in the HTTPRoute. With no `Origin`, Spring skips the CORS check entirely: ```yaml apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: rocketmq-dashboard spec: parentRefs: - name: <your-gateway> rules: - matches: - path: type: PathPrefix value: / filters: - type: RequestHeaderModifier requestHeaderModifier: remove: - Origin backendRefs: - name: rocketmq-dashboard port: 8082 ``` The nginx equivalent is `proxy_set_header Origin "";` (an empty value makes nginx drop the header), and for ingress-nginx the same line goes into the `nginx.ingress.kubernetes.io/configuration-snippet` annotation. We verified this on 2.1.0 behind Envoy Gateway with an F5 doing TLS offload: login works over the HTTPS domain, over a `kubectl port-forward` / SSH tunnel on a non-80 port, and over plain HTTP. Security-wise little changes: CSRF (`XSRF-TOKEN` cookie + `X-XSRF-TOKEN` header) still protects every write, and since the app no longer sees an `Origin` it never returns `Access-Control-Allow-Origin`, so other sites still can't read responses. For the record, the RocketMQ Studio rewrite on `master` makes this configurable (`STUDIO_CORS_ALLOWED_ORIGINS`), but 2.x users have nothing short of a proxy workaround or a rebuilt image. It would be great if the 2.x `SecurityConfig` could read the allowed origins from a property too. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
