Consider creating a CORS http filter.

[WhileLoop]

In order to process CORS preflight requests through Envoy we would need a HTTP filter which would intercept OPTIONS requests and respond with the proper headers.

[mattklein123]

This is a trivial filter to write. If anyone is looking for a good starter project let me know.

[WhileLoop]

I might have some bandwidth this weekend, just point me in the right direction.

[mattklein123]

@RomanDzhabarov is going to provide some tips

[RomanDzhabarov]

hey @WhileLoop let me put some notes on developing a new filter. That should be a good starting point, but let me know if you have any additional questions.

Developing filters
There are many examples of L7 filters we are using, DynamoFilter and others, the simplest one which would help you better understand how filter works is buffer_filter.

You'd need to figure out if your filter is decoder (process request headers/data/etc)/encoder (process response headers/data/etc)/or both, likely if you only need to inspect request to upstream and not response from upstream you'll end up with decoder filter.

Connection manager runs though filters sequentially, to better understand different values decodeHeaders/Data returns you can check comments in here.

Configuration/Registration
Static filter registration and configuration is defined in Server::Configuration namespace, for example, here
So you'd need to make registration similar to this.

Tests
Tests can be found here

[mattklein123]

@AdamCmiel will be working on this and will propose a design soon.

[AdamCmiel]

Thanks for the introduction @mattklein123, here's my proposed implementation

CORS support in envoy

What is CORS?

Background

Currently, it is up to services to properly implement CORS. As web clients seek to consume APIs served by envoy, it is clear that envoy should include a CORS filter, allowing backend services to scale without concern for platform-specific clients. This makes for easier scalability, maintainability, and a uniform CORS API design which helps to mitigate security risk.

Filter Design

Cors responses to OPTIONS requests will be parsed by a decoder filter that reads incoming headers and request method and will either respond with certain headers or pass through requests to other filters.

Configuration

Envoy will support configuration at the virtual host and route level. Each will allow a JSON configuration as shown below. A virtual host's or route's cors.allow_origin and cors.allowed_methods should specify the default Access-Control-Allow-Origin and Access-Control-Allowed-Methods headers, respectively.

The fields below should map to the following response headers:

Table 1: Cors Headers from config

Config	Response Header	Required
cors.allow_origin	Access-Control-Allow-Origin	true
cors.allow_methods	Access-Control-Allow-Methods	false
cors.allow_headers	Access-Control-Allow-Headers	false
cors.expose_headers	Access-Control-Expose-Headers	false
cors.max_age	Access-Control-Max-Age	false
cors.allow_credentials	Access-Control-Allow-Credentials	false

If the route has a configuration option cors.enabled of false, cors headers will not be supported on this route

Code 1: Example configuration

{
	"virtual_hosts": [
    	{
        	"name": "api",
            //...
            
            "cors": {
            	"allow_origin": "(www|ww2|shop).example.com"
            }
            
            //...
            
            "routes": [
            	{
                	"prefix": "/shop_only_resource",
                    "cors": {
                    	"allow_origin": "shop.example.com"
                    },
                    
                    //...
                },
                {
                	"prefix": "/internal_external_resource",
                    "cors": {
                    	"allowed_methods": "PUT POST"
                    },
                    
                    //...
                },
                {
                	"prefix": "/web_not_accessible_resource",
                    "cors": {
                    	"enabled": false
                    },
                    
                    //...
                }
            ]
        }
    ]
    
}

Implementation

How the CORS filter should handle incoming requests

1. If the request method is NOT "OPTIONS", pass through to the next filter
2. If the route config or virtual_host config has cors.enabled as false, pass through to the next filter
3. Let cors_config be the route cors config option, defaulting to the cors config specified by the virtual host (Look up keys first on the route then the virtual host)
4. If cors_config.allow_origin is missing, pass through to the next filter
5. Assign values to the cors headers in the repsponse: For each of the headers specified in Table 1 above:
   a. let value be the option for the header config
   b. if value is not defined, continue to the next header
   c. else, write the response header for the specified config option
6. Let allow_credentials be cars_config.allow_credentials
   a. If allow_credentials is false, remove the Access-Control-Allow-Credentials header from the response and continue to step 7
   b. else let request_origin be the incoming request's origin header
   c. if request_origin missing, continue to step 7
   d. if request_origin does match the cors.allow_origin pattern, write the Access-Control-Allow-Credentials header as true
   d. else remove the Access-Control-Allow-Credentials header from the response
7. Assign status code 200
8. Respond

[mattklein123]

@AdamCmiel this looks great to me. Thanks for the detailed write up. I think we can get started on the implementation. I will move into the 1.4.0 milestone but we can move into 1.3.0 if it lands in that timeframe.

[codesuki]

@mattklein123 I want to implement this filter according to the specs above.
I need your guidance for adding the config to the virtual_host and route section.
Until recently it seemed to be easy. I added the needed code to router/config_impl.h but in router/config_impl.cc all the code was changed to use protobuf.
( #1430 )
Do I have to change the protobuf (add the cors settings there)?