Invalid CORS request

[kauth-coder]

写死了 origin 大哥们

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("http://localhost:3003"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
        configuration.setAllowedHeaders(Arrays.asList("content-type", "Authorization", "X-Requested-With", "Origin", "Accept", "X-XSRF-TOKEN"));
        configuration.setAllowCredentials(true);
        configuration.setMaxAge(3600L);

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

这个 configuration.setAllowedOrigins(Arrays.asList("http://localhost:3003")); 这个玩意为啥要写死啊，我部署到k8s后 用域名一直请求不通
现在我只能用 postman 手动调用接口 指定 Origin、Referer
真狗啊

[kauth-coder]

自己回复一下，已经解决了，解决方案 在 nginx 层覆写 Origin、Referer
比如说我这个是用k3s 部署的 用的 nginx Ingress 直接指定Origin、Referer. yaml脚本如下：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: rocketmq-dashboard
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: rocketmq-dashboard
  template:
    metadata:
      labels:
        app: rocketmq-dashboard
    spec:
      containers:
      - name: dashboard
        image: apacherocketmq/rocketmq-dashboard:2.1.0
        env:
        - name: JAVA_OPTS
          value: "-Drocketmq.namesrv.addr=rocketmq-nameserver:9876"
        ports:
        - containerPort: 8082

---
apiVersion: v1
kind: Service
metadata:
  name: rocketmq-dashboard
  namespace: default
spec:
  type: ClusterIP
  selector:
    app: rocketmq-dashboard
  ports:
  - port: 8080
    targetPort: 8082

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rocketmq-dashboard-ingress
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Origin "http://localhost:3003";
      proxy_set_header Referer "http://localhost:3003";
spec:
  ingressClassName: nginx
  rules:
  - host: rocketmq.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: rocketmq-dashboard
            port:
              number: 8080

[kauth-coder]

如果你是 nginx 直接反向代理的话 更简单了

server {
    listen 80;
    server_name localhost;

    location / {
        proxy_pass http://127.0.0.1:8082;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 覆写指定 Header
        proxy_set_header Origin "http://localhost:3003";
        proxy_set_header Referer "http://localhost:3003";
    }
}

[oss-sentinel-ai]

Assessment by github-manager-bot

Type: Bug
Priority: Medium

Summary

The CORS configuration in rocketmq-dashboard hardcodes http://localhost:3003 as the only allowed origin, preventing deployment in production environments with different origins.

Analysis

This is a valid configuration issue. The hardcoded origin in CorsConfigurationSource bean prevents flexible deployment scenarios. The allowed origins should be configurable via application properties or environment variables.

Suggestions

1. Make allowed origins configurable via application.properties (e.g., rocketmq.dashboard.cors.allowed-origins)
2. Support comma-separated multiple origins
3. Add documentation for production CORS configuration

Verdict

Valid bug — The CORS configuration should be externalized for production deployments.

---

Automated assessment by github-manager-bot

[RockteMQ-AI]

Issue Evaluation

Category: type/enhancement | Status: Evaluated

Thank you for this enhancement suggestion. This has been noted for community discussion.

If you'd like to contribute a fix, feel free to submit a PR. The maintainers will review and provide feedback.

---

Automated evaluation by RockteMQ-AI

[github-actions]

This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.