quarkus: blocked by CORS policy

Question

although I configured the property file I still get the error:

blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I also created a @Provider extending ContainerRequestFilter, but it never reaches there

application.properties

# Configuration file
quarkus.http.port=9090
quarkus.http.cors=true
quarkus.http.origins=http://localhost:4200, localhost:9090
quarkus.http.headers=accept, authorization, content-type, x-requested-with
quarkus.http.methods=GET, OPTIONS

edited

17:11:09 WARN  [io.qu.config]] (build-3) Unrecognized configuration key "quarkus.http.methods" provided
17:11:09 WARN  [io.qu.config]] (build-3) Unrecognized configuration key "quarkus.http.headers" provided
17:11:09 WARN  [io.qu.config]] (build-3) Unrecognized configuration key "quarkus.http.origins" provided

Answer 1

The warnings were a good indication.

Your configuration is incorrect.

It should be something like:

quarkus.http.cors.origins=http://localhost:4200,http://localhost:9090
quarkus.http.cors.headers=accept, authorization, content-type, x-requested-with
quarkus.http.cors.methods=GET, OPTIONS

with the cors prefix.

We don't have proper documentation right now so better refer to https://github.com/quarkusio/quarkus/blob/master/extensions/undertow/runtime/src/main/java/io/quarkus/undertow/runtime/filters/CORSConfig.java .

I opened https://github.com/quarkusio/quarkus/issues/3156 to track the documentation issue.

Answer 2

Try the following code, this worked for me.

<code>
@Provider   
public class CorsFilter implements ContainerResponseFilter {
  @Override
  public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException {
    responseContext.getHeaders().add("Access-Control-Allow-Origin", "*");
    responseContext.getHeaders().add("Access-Control-Allow-Credentials", "true");
    responseContext.getHeade`enter code here`rs().add("Access-Control-Allow-Headers", "*");
    responseContext.getHeaders().add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, HEAD");
    responseContext.getHeaders().add("Access-Control-Max-Age", "100000");
  }
}
</code>