I have a Spring websocket application that I want to access from another client.
I am using sockjs
to do this.
When connection to http://localhost:8080/hello/info is attempted to open, I get a 403 (forbidden)
error.
Here is my CORS conf in Spring:
@Component
public class SimpleCORSFilter implements Filter {
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletResponse response = (HttpServletResponse) res;
response.setHeader("Access-Control-Allow-Origin", "http://localhost:3000");
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setHeader("Access-Control-Max-Age", "3600");
response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT, DELETE, HEAD, PATCH");
response.setHeader("Access-Control-Allow-Headers",
"Origin, Content-Type, Accept, Cookie, Connection, Accept-Encoding, Accept-Language, Content-Length, Host, Referer, User-Agent");
chain.doFilter(req, res);
}
public void init(FilterConfig filterConfig) {}
public void destroy() {}
}
If I try to use the socket from the page that Spring it self server, it works without problems. But when I do it from another client that uses that same Angular code that I have in Spring, it fails with the error above.
Here is the comparison of Request headers:
Working header:
GET /hello/info HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/41.0.2272.76 Chrome/41.0.2272.76 Safari/537.36
Accept: */*
Referer: http://localhost:8080/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: et-EE,et;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: remember_token=Q9M8fpJa13SsrXJOUDwVAg; _test1_session=N0wvOWV5cTU3VWd2TEs0SnZ2RkVqQ0lzN2tkbndzWmlodVl0VVl5eFdsR1FvYURKMEV0cFFsU2RpK2ZiVTF6ZHZLdFJnSUY0Ukl1Nloxd29QQlNFTmFBT2ZjbVA4M1ZzUEZubDZHSWFRTjhidVlTa3JoZE9MbEhBRGg5SmhmandRWkxNSXQ1cXFLb3ZRTXFLLzZGZGp3PT0tLXZ3czlJLzZxUjloR0EwcHlrdVVwc2c9PQ%3D%3D--c152b026e7859d5e8a5e8f260b66b33a6921f3b7; _harjutus_session=eVlEeU1nWjc4QjZhM0M4bEZQQ0FtVEp6UnFCYVkzUld1bVNDMVpTK1M2SmVjMEpQZlBSWWQ0YUxLczNZeGs5cGVJbWMybWxpN0lzKzBlRGJsR1JCVnQyN21ZWWZLMDJpZU1ENHE2VlJUcVFSdnU1aUVNOUpCOW5Cdyt2QSt0K2JrcHIzME56ZURlbTBtYmlTSlozcWpYY1FLMVlhMlVFWEp3WExNUHA1azdkWFpBY3NxQnJYeC90ZTJzR0NFa2VpYnNRcnp3c0ZOTVVmUDU4N2I4Zy92SHJMTDludVJYTkJtU3E2T0lGUFUwcEQrREtUUmtsdGdkWXVRR2lvN3pXMi0tTVB3WFB2M0NURDQvZlFwbm5UWEZqUT09--5e23d496aa3ecad4f5e7343ba8e326f18304844b
Not working header:
GET /hello/info HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Cache-Control: max-age=0
Origin: http://localhost:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/41.0.2272.76 Chrome/41.0.2272.76 Safari/537.36
Accept: */*
Referer: http://localhost:3000/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: et-EE,et;q=0.8,en-US;q=0.6,en;q=0.4
Is the problem with the cookie header?
I did this the problematic client but nothing changed. But it should not matter also as both my Spring application and the Ruby on Rails application have exactly the same Angular code that is used to connect to the websocket.
app.config([
'$httpProvider', function($httpProvider) {
$httpProvider.defaults.withCredentials = true;
}
]);
EDIT: accessing the websocket URL in browser shows this: {"entropy":-319177751,"origins":["*:*"],"cookie_needed":true,"websocket":true}
Can the cookie_needed be turned off somehow? I fail to find anything in Spring docs for it.
You use websockets, so if you have the newest version of Spring it could be that you didn't specify the allowed origins. According to the documentation, 21.2.6 Configuring allowed origins, only same origin requests are allowed by default for websockets as of Spring 4.1.5.
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments