cloudbase-ai opened a new pull request, #7901: URL: https://github.com/apache/shenyu/pull/7901
Fixes #7370. An allowed `https://frontend.example` origin is currently prefixed with `http://` when the gateway receives an HTTP request, so it fails the allow-list check. Trim configured origins and preserve their explicit scheme; scheme-less entries continue to inherit the gateway request scheme. Add `Vary: Origin` before response commitment, after upstream response headers have been applied. Preserve existing Vary tokens, recognize an existing Origin token case-insensitively, and retain `Vary: *`. Responses for absent or denied origins also vary by Origin so a cached response without CORS permission cannot be reused for an allowed request. Wildcard and `allowedAnyOrigin` modes continue reflecting concrete origins, including with credentials. As requested by the issue, the literal opaque `Origin: null` does not receive CORS permission through those modes. Denied preflights continue down the filter chain, preserving #6720's behavior. ### Validation The regression checks fail against the original implementation. After the fix, all 24 `CrossFilterTest` cases pass, including cross-scheme/trimmed/scheme-less origins, scheme/host/port rejection, preflight headers, credentials, wildcard modes, opaque origins, missing Origin, and Vary headers applied downstream. The selected reactor also passes Checkstyle and Apache RAT: ```sh ./mvnw -B -ntp -nsu -pl shenyu-web -am verify \ -Dtest=CrossFilterTest -Dsurefire.failIfNoSpecifiedTests=false \ -Djacoco.skip=true -Dmaven.javadoc.skip=true ``` These tests commit WebFlux mock responses; browser/proxy end-to-end tests and the full repository test suite were not run. Make sure that: - [x] You have read the [contribution guidelines](https://shenyu.apache.org/community/contributor-guide). - [x] You submit test cases (unit or integration tests) that back your changes. - [ ] Your local test passed `./mvnw clean install -Dmaven.javadoc.skip=true`. Focused verification is listed above. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
