Not possible to use allowedOrigins "*" in StompEndpointRegistry after upgrade to Spring Boot 2.4.0 #26111

opersson · 2020-11-18T13:18:01Z

Not sure if this should be filed under Spring Boot or Spring framework, but I put it here since Spring Boot Starter is in use.

After upgrading to use Spring Boot 2.4.0 from 2.3.x, it does not seem to be possible to use allowedOrigins = "*" in the StompEndpointRegistry. When connecting it results in the following Error:

java.lang.IllegalArgumentException: When allowCredentials is true, allowedOrigins cannot contain the special value "*"since that cannot be set on the "Access-Control-Allow-Origin" response header. To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead.

However, allowedOriginPatterns i not something that is available on the StompEndpointRegistry, only allowedOrigins is available.

Code to reproduce

package com.example.demo;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.socket.config.annotation.EnableWebSocketMessageBroker;
import org.springframework.web.socket.config.annotation.StompEndpointRegistry;
import org.springframework.web.socket.config.annotation.StompWebSocketEndpointRegistration;
import org.springframework.web.socket.config.annotation.WebSocketMessageBrokerConfigurer;

@SpringBootApplication
@EnableWebSocketMessageBroker
public class DemoApplication implements WebSocketMessageBrokerConfigurer {

	public static void main(String[] args) {
		SpringApplication.run(DemoApplication.class, args);
	}

	@Override
	public void registerStompEndpoints(StompEndpointRegistry registry) {
		StompWebSocketEndpointRegistration registration = registry.addEndpoint("/endpoint");
		registration.setAllowedOrigins("*");
		registration.withSockJS();
	}
}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
    <script>
        fetch("http://localhost:8080/endpoint")
            .then(response => console.log(response));
    </script>
</head>
<body>
</body>
</html>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.4.0</version>
		<relativePath/> <!-- lookup parent from repository -->
	</parent>
	<groupId>com.example</groupId>
	<artifactId>demo</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<name>demo</name>
	<description>Demo project for Spring Boot</description>

	<properties>
		<java.version>11</java.version>
	</properties>

	<dependencies>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-websocket</artifactId>
		</dependency>
	</dependencies>

	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>
		</plugins>
	</build>

</project>

Start the server on port 8080 and host the host the html file on another port and open it in a browser.

The text was updated successfully, but these errors were encountered:

wilkinsona · 2020-11-18T13:28:52Z

Thanks for the report. The behaviour that you're seeing is due to these changes in Spring Framework. We'll transfer this issue to the Framework team so that they can take a look.

rstoyanchev · 2020-11-18T16:45:29Z

#25016 introduced the ability to configure allowedOriginPatterns in addition to just allowedOrigins. It lets you define more flexible patterns while the latter is literally the value to return in the Access-Control-Allow-Origin header and for that "*" is not allowed in combination with allowCredentials=true. The change introduced equivalent allowedOriginPatterns methods in the WebMvc and the WebFlux config, but not in the SockJS config and the AbstractSocketJsService.

I'll add those for 5.3.2. You'll then need to switch to allowedOriginPatterns instead of allowedOrigins but that gives you an option to define more precisely the allowed domain patterns. In the mean time, you might be able to work around by listing specific domains if that's feasible.

rstoyanchev · 2020-11-18T17:11:25Z

This is now superseded by #26108.

See spring-projects/spring-framework#26111

JeromeRider · 2021-02-10T13:53:50Z

When I implement WebSocketMessageBrokerConfigurer, I'm not asked to override registerStompEndpoints() method. Am I supposed to use Java 11 ? I'm on Java 8 - Maven 2.4.2

rstoyanchev · 2021-02-10T15:49:49Z

@JeromeRider, all are default methods and so none are required. Imagine that there are several of these in one application. They are all applied, and one might register endpoints while others might not.

richvim · 2021-02-19T09:18:59Z

This massively burned us during upgrade, why was this breaking change not mentioned in the release notes?

rstoyanchev · 2021-02-19T18:19:31Z

@richvim I'm sorry to hear that. It is mentioned here although I can see how we should probably more explicitly mention STOMP web messaging as part of that.

alrawasabed · 2021-02-23T08:37:28Z

The interface WebSocketHandlerRegistration is still missing setAllowedOriginPatterns in spring-websocket-5.3.3
I use it when I override registerWebSockerHandlers(WebSocketHandlerRegistry registry) when implementing WebSocketConfigurer

It's supposed to be there right?

rstoyanchev · 2021-02-23T12:44:53Z

@alrawasabed yes it should be there. I've created #26593.

spring-projects/spring-framework#26111 spring-projects/spring-boot#5834 https://spring.io/guides/gs/rest-service-cors/

cors 간단한 이슈 해결 cors정책을 모든 도메인에 대한 허용으로 바꾸기 위해 addAllowedOrigin("*")으로 했었는데 When allowCredentials is true, allowedOrigins cannot contain the special value "*"since that cannot be set on the "Access-Control-Allow-Origin" response header. To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead. 브라우저에서 요청을 보내면 위와같은 알아 듣기 힘든 오류를 뱉음 spring-projects/spring-framework#26111 버전 문제인 듯하고 좀더 조사필요 일단 addAllowedOriginPattern("*")으로 메소드를 변경하니 원하는 대로 동작

See - spring-projects/spring-framework#26111

…in Spring Framework - spring-projects/spring-framework#26111

`Access-Control-Allow-Origin: *` is not allowed when `Access-Control-Allow-Credentials: true`. Spring introduced allowedOriginPatterns() in 5.3.2. If any of the patterns matches the origin of the _request_, the it is used as a value of `Access-Control-Allow-Origin` in the response. For context, see spring-projects/spring-framework#26111.

bclozel transferred this issue from spring-projects/spring-boot Nov 18, 2020

spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Nov 18, 2020

rstoyanchev self-assigned this Nov 18, 2020

rstoyanchev added in: messaging Issues in messaging modules (jms, messaging) type: regression A bug that is also a regression and removed status: waiting-for-triage An issue we've not yet triaged or decided on labels Nov 18, 2020

rstoyanchev added this to the 5.3.2 milestone Nov 18, 2020

rstoyanchev linked a pull request Nov 18, 2020 that will close this issue

Support allowedOriginPatterns in SockJS config #26108

Closed

rstoyanchev closed this as completed Nov 18, 2020

rstoyanchev removed this from the 5.3.2 milestone Nov 18, 2020

rstoyanchev added the status: superseded An issue that has been superseded by another label Nov 18, 2020

rieckpil added a commit to stratospheric-dev/stratospheric that referenced this issue Nov 20, 2020

temp. disable CORS for STOMP endpoint

f781301

See spring-projects/spring-framework#26111

randomnicode mentioned this issue Jan 18, 2021

Fix websockets issue with update to Spring boot 2.4.2 airsonic-advanced/airsonic-advanced#433

Merged

rstoyanchev mentioned this issue Feb 23, 2021

WebSocketHandlerRegistration is missing option for allowedOriginPatterns #26593

Closed

vikramsan added a commit to CBIIT/cadsr-services that referenced this issue Mar 1, 2021

Fixing CORS issues by limiting Cross origin domains

61acf4b

spring-projects/spring-framework#26111 spring-projects/spring-boot#5834 https://spring.io/guides/gs/rest-service-cors/

CaptainIRS added a commit to delta/codecharacter-server-2020 that referenced this issue Mar 21, 2021

Restrict allowed origin due to spring-projects/spring-framework#26111

9555a84

gracefulBrown mentioned this issue Mar 22, 2021

GET /stations, /lines CORS 오류 woowacourse/javascript-subway#20

Closed

lndobryden pushed a commit to FordLabs/retroquest that referenced this issue May 25, 2021

Update CORS filter for websockets

0c50bd8

See - spring-projects/spring-framework#26111

lndobryden mentioned this issue May 25, 2021

Update CORS filter for websockets FordLabs/retroquest#300

Merged

lndobryden pushed a commit to FordLabs/retroquest that referenced this issue May 26, 2021

Update CORS filter for websockets (#300)

e6dafc4

See - spring-projects/spring-framework#26111

oxbx06 pushed a commit to cisagov/FLAREclient-Java that referenced this issue Jul 27, 2021

Added Cors Option allowed-origin-patterns based upon the change made …

9e02a1a

…in Spring Framework - spring-projects/spring-framework#26111

CodeDiary18 mentioned this issue Jul 20, 2024

[TIL-76] 백엔드-프론트 연동 CORS 오류 수정 SOMA-TIL/TIL-Backend#20

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Not possible to use allowedOrigins "*" in StompEndpointRegistry after upgrade to Spring Boot 2.4.0 #26111

Not possible to use allowedOrigins "*" in StompEndpointRegistry after upgrade to Spring Boot 2.4.0 #26111

opersson commented Nov 18, 2020

wilkinsona commented Nov 18, 2020 •

edited

Loading

rstoyanchev commented Nov 18, 2020

rstoyanchev commented Nov 18, 2020

JeromeRider commented Feb 10, 2021

rstoyanchev commented Feb 10, 2021 •

edited

Loading

richvim commented Feb 19, 2021

rstoyanchev commented Feb 19, 2021

alrawasabed commented Feb 23, 2021 •

edited

Loading

rstoyanchev commented Feb 23, 2021

Not possible to use allowedOrigins "*" in StompEndpointRegistry after upgrade to Spring Boot 2.4.0 #26111

Not possible to use allowedOrigins "*" in StompEndpointRegistry after upgrade to Spring Boot 2.4.0 #26111

Comments

opersson commented Nov 18, 2020

wilkinsona commented Nov 18, 2020 • edited Loading

rstoyanchev commented Nov 18, 2020

rstoyanchev commented Nov 18, 2020

JeromeRider commented Feb 10, 2021

rstoyanchev commented Feb 10, 2021 • edited Loading

richvim commented Feb 19, 2021

rstoyanchev commented Feb 19, 2021

alrawasabed commented Feb 23, 2021 • edited Loading

rstoyanchev commented Feb 23, 2021

wilkinsona commented Nov 18, 2020 •

edited

Loading

rstoyanchev commented Feb 10, 2021 •

edited

Loading

alrawasabed commented Feb 23, 2021 •

edited

Loading