refers to feature request kubernetes#5496 If there's a star in a wildcard domain, it must be replaced with If it's a wildcard domain or any domain (without a wildcard), it MUST If there is a `*` it ill be short-circuited by first if. There was no need for logic in template.go for buildCorsOriginRegex * remove unecessary logic for building cors origin + remove comments In detail, CORS is a protection system implemented by web browsers to enforce. In this context, an origin refers to the combination of the protocol, domain, and port number a request comes from.

(supplied but empty) and if it wasn't supplied at all. CORS is a security mechanism that enables a server to specify which origins are allowed to access and load resources in a web browser. re-add `*` to cors parsing if trimmed cors-allow-origin is empty * Re-add `*` when no cors origins are supplied + fix tests test properly by validating that the value returned is the proper modify template to properly enable only if the whole block is enabled use string instead of basic string to avoid reparsing in template.go * Remove automatic `*` fonctionality from incorrect origins * support single-level wildcard subdomains + tests * add support for optional port mapping on origin * modify documentation for cors and remove dangling comment * add TrimSpace and length validation before adding a new origin properly escape regex using 'QuoteMeta' add origin validation in cors ingress annotations * Modify tests and add some logic for origin validation * fix 'should enable cors test' looking at improper values * add tests + use search to identify '*' origin add buildOriginRegex function in nginx.tmpl bump cluster version for `make dev-env` * Add Initial support for multiple cors origins in nginx # Tell client that this pre-flight info is valid for 20 daysĪdd_header 'Access-Control-Max-Age' 1728000 Īdd_header 'Content-Type' 'text/plain charset=UTF-8' # Custom headers and headers various browsers *should* be OK with but aren't # Catch all incase there's a request method we're not dealing with properlyĪdd_header 'Access-Control-Allow-Origin' '$http_origin' Īdd_header 'Access-Control-Allow-Credentials' 'true' Īdd_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' Īdd_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type' ServiceName: ui-svc servicePort: 8080 path: / ui. secretName: stand01-06-example-com-crt-fullchain rules: If youre using a Global CORS with Springboot and want to add multiple domains, this is how Ive done it: In your property file, you can add your property and domains as below: . has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values ', ', but only one is allowed. Kubernetes.io/ingress.class: 'nginx ' cert-manager.io/cluster-issuer: 'letsencrypt-prod ' /configuration-snippet: | if ($http_origin ~* '^https?://((?: name: ui-https-cors-ing spec: ApiVersion: /v1beta1 kind: Ingress metadata:

Access control allow origin multiple