imbajin commented on code in PR #750:
URL:
https://github.com/apache/hugegraph-toolchain/pull/750#discussion_r3698025947
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/config/GlobalCorsConfig.java:
##########
@@ -35,6 +35,7 @@ public CorsFilter corsFilter() {
config.setAllowCredentials(false);
config.addAllowedMethod("*");
config.addAllowedHeader("*");
+ config.setMaxAge(3600L);
Review Comment:
‼️ **Critical: the configured preflight cache is unreachable.** This
`CorsConfiguration` never sets `allowedOrigins`; in the pinned Spring Web
5.1.9, `checkOrigin()` returns `null` for an empty origin list and
`DefaultCorsProcessor` rejects the preflight before it reaches the branch that
writes `Access-Control-Max-Age`. Same-origin requests do not need CORS
preflight processing, so this line cannot implement the PR's stated behavior.
Please either remove this ineffective setting while Hubble remains
same-origin-only, or first add an explicit trusted-origin configuration and an
`OPTIONS` regression test proving that an allowed origin receives
`Access-Control-Max-Age: 3600` while untrusted origins remain rejected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
