quarkus: blocked by CORS policy

Question

although I configured the property file I still get the error:

blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I also created a @Provider extending ContainerRequestFilter, but it never reaches there

application.properties

# Configuration file
quarkus.http.port=9090
quarkus.http.cors=true
quarkus.http.origins=http://localhost:4200, localhost:9090
quarkus.http.headers=accept, authorization, content-type, x-requested-with
quarkus.http.methods=GET, OPTIONS

edited

17:11:09 WARN  [io.qu.config]] (build-3) Unrecognized configuration key "quarkus.http.methods" provided
17:11:09 WARN  [io.qu.config]] (build-3) Unrecognized configuration key "quarkus.http.headers" provided
17:11:09 WARN  [io.qu.config]] (build-3) Unrecognized configuration key "quarkus.http.origins" provided

Hi it seems like some methods are missing in the http.methods what are method are you using GET/POST/PUT? — EliKnaffo, Jul 09 '19 at 19:39
also does not work, not even with on the * nor empty or without the config line — icarus, Jul 19 '19 at 14:06

score 17 · Answer 1 · edited Jun 18 '23 at 16:40

The warnings were a good indication.

Your configuration is incorrect.

It should be something like:

quarkus.http.cors=true
quarkus.http.cors.origins=http://localhost:4200,http://localhost:9090
quarkus.http.cors.headers=accept, authorization, content-type, x-requested-with
quarkus.http.cors.methods=GET, OPTIONS

yaml config

quarkus:
  http:
    cors:
      ~: true
      origins: http://localhost:4200,http://localhost:9090
      headers: accept, authorization, content-type, x-requested-with
      methods: GET, OPTIONS, POST

with the cors prefix.

We don't have proper documentation right now so better refer to https://github.com/quarkusio/quarkus/blob/master/extensions/undertow/runtime/src/main/java/io/quarkus/undertow/runtime/filters/CORSConfig.java .

I opened https://github.com/quarkusio/quarkus/issues/3156 to track the documentation issue.

Hi Guillaume, yep, in the g-groups/zulip they already told me, I correct them all and try again with the same result I mean, no warnings anymore, but I cannot get into my resource from my angular app — icarus, Jul 11 '19 at 12:11
Documentation about CORS filter can be found here https://quarkus.io/guides/http-reference#cors-filter — Borislav Gizdov, May 10 '23 at 14:07

José Junior · Answer 2 · 2022-02-13T19:52:05.270

Try the following code, this worked for me.

<code>
@Provider   
public class CorsFilter implements ContainerResponseFilter {
  @Override
  public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException {
    responseContext.getHeaders().add("Access-Control-Allow-Origin", "*");
    responseContext.getHeaders().add("Access-Control-Allow-Credentials", "true");
    responseContext.getHeade`enter code here`rs().add("Access-Control-Allow-Headers", "*");
    responseContext.getHeaders().add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, HEAD");
    responseContext.getHeaders().add("Access-Control-Max-Age", "100000");
  }
}
</code>

Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). — Community, Feb 12 '22 at 23:02

quarkus: blocked by CORS policy

2 Answers2