Wiremock CORS not working

Question

I've been used wiremock effectively for some time now, and I wanted to enable CORS access to the mocked APIs.

I've tried setting Access-Control-Allow-Origin: * and other headers in the response header, both to no avail.

Here's an example of a mapping that I have:

{
    "request": {
        "method": "POST",
        "urlPattern": "/api/v2/general/login[\\/\\&\\?]*",
        "bodyPatterns": [{
            "equalToJson": "{\"password\":\"password\",\"username\":\"[email protected]\"} ",
            "jsonCompareMode": "LENIENT",
            "ignoreArrayOrder" : true,
            "ignoreExtraElements" : true
        }]
    },
    "response": {
        "status": 200,
        "headers": {
            "Content-Type": "application/json",
            "Access-Control-Allow-Origin" : "*",
            "Access-Control-Allow-Methods" : "*",
            "Access-Control-Allow-Headers": "Accept, Content-Type, Content-Encoding, Server, Transfer-Encoding",
            "X-Content-Type-Options" : "nosniff",
            "x-frame-options" : "DENY",
            "x-xss-protection" : "1; mode=block"
        },
        "bodyFileName": "/login_response_johncougar.json"
    }
}

What am I doing wrong here that's causing CORS to not work?

Thanks in advance.

Answer 1

I have just managed to fix this issue. Actually solution was here already Adding headers to Jetty in Wiremock.

Because your browser sends a CORS preflight request before making any actual request, you will need to set up your wiremock to stub the OPTIONS request and send back headers.

For example,
Access-Control-Allow-Origin = "*", Access-Control-Allow-Headers: "content-type", Access-Control-Allow-Methods = "POST, GET".

Access-Control-Allow-Headers's value has to be the same values the Access-Control-Request-Headers header contained Request header field Access-Control-Allow-Headers is not allowed by itself in preflight response.

All your responses have to send back header "Access-Control-Allow-Origin": "*" as well.

Answer 2

Here is a sample and this works

{
 "request":
 {
 "urlPattern": "/country/([a-z]*)",
 "method": "GET"
 },

 "response":
 {
 "status": 200,
 "headers":
 {
 "Content-Type" : "application/json",
 "Access-Control-Allow-Origin" : "*",
 "Access-Control-Allow-Methods" : "*",
 "Access-Control-Allow-Headers": "Accept, Content-Type, Content-Encoding, Server, Transfer-Encoding",
 "X-Content-Type-Options" : "nosniff",
 "x-frame-options" : "DENY",
 "x-xss-protection" : "1; mode=block"
 },
 "body": "{ \"statusCode\" : \"S1000\", \"statusDescription\" : \"Success\", \"content\" : [ { \"id\" : \"1111\", \"name\" : \"aaaa\"}, { \"id\" : \"2222\", \"name\" : \"asd\" } ] }"
 }
}

Use this as it is, wiremock is peculiar when it comes to spacing, here i have used a single space instead of tab, hope it helps.

Answer 3

I had the same problem. After a long time search without finding the solution I started to play with the groovy file and finally I found the solution.

You just need to add each header in header() method. this will solve the problem. So your sample groovy contract will be like this:

{
  "request": {
    "method": "POST",
    "urlPattern": "/api/v2/general/login[\\/\\&\\?]*",
    "bodyPatterns": [{
      "equalToJson": "{\"password\":\"password\",\"username\":\"[email protected]\"} ",
      "jsonCompareMode": "LENIENT",
      "ignoreArrayOrder": true,
      "ignoreExtraElements": true
    }]
  },
  "response": {
    "status": 200,
    "headers": {
      header("Content-Type": "application/json"),
      header("Access-Control-Allow-Origin": "*"),
      header("Access-Control-Allow-Methods": "*"),
      header("Access-Control-Allow-Headers": "Accept, Content-Type, Content-Encoding, Server, Transfer-Encoding"),
      header("X-Content-Type-Options": "nosniff"),
      header("x-frame-options": "DENY"),
      header("x-xss-protection": "1; mode=block")
    },
    "bodyFileName": "/login_response_johncougar.json"
  }
}

I hope it will solve your problem (Actually it will be useful if you use groovy contracts).