Closed jwmay2012 closed 1 year ago
Also reproduced on v0.11.0
Same problem here
Same problem here!
Please use a separate gateway as a workaroudn for now, we will most likely remove CORS configuration from Ory Kratos in the forseeable future!
I'll go ahead and post my kubernetes/traefik solution then--
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: kratos-cors
namespace: kratos
spec:
headers:
accessControlAllowMethods:
- POST
- GET
- PUT
- PATCH
- DELETE
accessControlAllowOriginList:
- https://mydomain.com
accessControlAllowHeaders:
- Authorization
- Cookie
- Content-Type
accessControlExposeHeaders:
- Content-Type
- Set-Cookie
accessControlMaxAge: 100
addVaryHeader: true
accessControlAllowCredentials: true
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: kratos-public
namespace: kratos
spec:
entryPoints:
- websecure
routes:
- match: Host(`kratos-public.mydomain.com`) || Host(`kratos.mydomain.com`)
kind: Rule
middlewares:
- name: kratos-cors
services:
- name: kratos-public
port: 80
tls:
secretName: kratos-public-mydomain-com
Can Oathkeeper's header Mutator be used to add response headers?
Thanks! That's exactly the route I took!
Mm but how would you solve this when working with docker-compose on a local machine?
Well, some gateway/proxy is still required to add the headers. Unless I'm mistaken, Oathkeeper only adds headers for incoming requests to the backend, not to outgoing responses. So something else is needed.
I would be including Traefik in my docker-compose environments as well. I usually do anyways because I like using domain names over ports and https(+mkcert) over http. (especially for Kratos testing) And it makes it similar to my "production" homelab Portainer compose deployments.
I don't have an example on hand, but here's the Traefik CORS Docs.
For work, I use Tilt for local, with Traefik.
To me then it seems that removing CORS configuration will make local development considerably more complicated than it is now. Will the quickstart in the docs also be updated to show how to deal with this?
I think the quickstart uses the server-side browser flow example UI, correct? CORS issues won't arise until you've started doing client side AJAX flows. I suppose that's how I've gone 3 months tinkering with kratos/ory without noticing the CORS issues until we started integrating with our SPA. 🤷🏻♂️
But yeah, this doc page should be replaced.
We also welcome hotfixes to the problem! Maybe the middleware is misisng or something :)
I encountered the same problem during migration from v0.10 to v0.11. I think this change introduced the error:
The interesting thing is that OPTIONS request/response is working correctly but not knowing why CORS response headers disappear during the actual request.
Closed via https://github.com/ory/kratos/pull/2934
I already use Envoy in front of Kratos to control access to the admin APIs, but this broke my setup locally and I also had to deploy a hotfix to my proxy config as I was expecting Kratos to control the CORS headers. Is there a hotfix version going to be released with #2934 anytime soon?
Yes, the hotfix version with #2934 is much needed. Is there any updates on that?
Preflight checklist
Describe the bug
CORS related headers are claimed by kratos logs to be added to
/self-service/login/browser
response, but no such headers are present.Reproducing the bug
curl -v -H "Origin: https://mydomain.com/" -H "Accept: application/json" http://auth.mydomain.com/self-service/login/browser
Notice absence of any CORS headers.
[cors]
logs claim proper headers were added. CURL/Browser disagrees.Relevant log output
Relevant configuration
Version
v0.11.0-alpha.0.pre.2
On which operating system are you observing this issue?
Linux
In which environment are you deploying?
Kubernetes
Additional Context
Browser's view:
Workaround is to manually set the CORS headers with a reverse proxy like Traefik.