JWT plugin also blocks OPTIONS pre-flight messages

[jamestenglish]

Summary

Current the JWT plugin also blocks OPTIONS requests. Many libraries don't give the user the option to specify headers for the OPTIONS pre-flight. I.E. Angular HTTP module

Steps To Reproduce

$ curl -k -X OPTIONS https://KONG_URL:8443/API
{"message":"Unauthorized"}

Additional Details & Logs

• Kong version 0.10.2
• Operating System centos

Workaround

Currently you append ?jwt=.... to your URLs along with configuring the authorization header, but that makes the urls super ugly

[Tieske]

workaround: #1535 (comment)

[jamestenglish]

@Tieske Maybe I didn't look closely enough, but can you apply the plugin to all APIs and then remove it for certain APIs (like for options?). Ideally we don't want the overhead/risk of having to remember to apply to all new APIs

[p0pr0ck5]

@jamestenglish currently there is no negative model for global plugin assignment (e.g., there is no way to apply a plugin to all execept n APIs). This doesn't make the workaround noted above any less valid, though :)

[lucastheisen]

@p0pr0ck5 , Just a little clarification on your workaround:

For now, one could workaround this by creating a separate API that forwards to the same upstream, handling only OPTIONS requests, that does not have this plugin enabled.

Does this mean i need to PATCH my original API limiting it's methods to exclude OPTIONS and then add this addtional API, or can i have 2 api's with the same hosts both serving OPTIONS and one get prioritized over the other?

--- EDIT ---
After just adding the additional API, it seems to work, however, it would be nice to know a little detail as to which API is chosen to serve a given request... I did not specify an methods on the original so assume it would serve all of them. That means I have 2 APIs that would fit this request... Why is one chosen over the other?

[thibaultcha]

it would be nice to know a little detail as to which API is chosen to serve a given request

@lucastheisen Please see the docs https://getkong.org/docs/latest/proxy/