Cors headers does not seem to get sent out

[rleinfellner]

I am not sure what I am doing wrong

using akka-http-cors 1.1.2 in a scala web project with

val route: Route = extractUri { uri => handleExceptions(myExceptionHandler) { handleRejections(myRejectionHandler) { cors() { get { pathPrefix(defaultStaticReactEndpoint) { extractMatchedPath { matched => log.info("From Static {} URI:{}", matched, uri) getFromDirectory(defaultWebsiteStatic) } } } } } } }

This runs on a server say test.site1.com and its content is being cross site referenced from another domain site2.com, both are https://

In config I have

allowed-origins = "https://*.site1.com"

site2 just contains some html to do a cross site access

site2.org

This works fine & serves the image from test.site1.com via site2.com

However when I change

allowed-origins = "https://*.BADsite1.com"

despite the site no no longer being whitelisted it still works and serves the image

I also noticed that the headers for the site 2 access have no-cors set despite being flagged as cross site, so it looks like the wrapper is not sending Access-Control-Allow-Origin: https://*.site1.com in the header

Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site

I was under the impression the cors {} wrapper added the required headers to enforce cors

Also when I add allow-generic-http-requests = no it now fails for all requests, which I suspect is due to chrome not realising is supposed to send Origin

I checked this by adding optionalHeaderValueByType(Origin) { origin => }

and for all requests its None

I'd like to use cors to lock down cross site access to named sites, and right now its seems to either allow everything or forbid it

Help would be gratefully appriciated

_____Full headers

Request

Request URL: https://test.site1.com/static/media/landt.56f7a83a.png Request Method: GET Status Code: 200 OK Remote Address: 127.0.0.1:443 Referrer Policy: strict-origin-when-cross-origin

Response

Accept-Ranges: bytes Content-Length: 17398 Content-Type: image/png Date: Tue, 04 Jan 2022 12:49:24 GMT ETag: "6fc2017dde802faf" Last-Modified: Tue, 21 Dec 2021 19:38:02 GMT Server: akka-http/10.2.7

Request GET /static/media/landt.56f7a83a.png HTTP/1.1 Host: test2.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="96", "Google Chrome";v="96" DNT: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 sec-ch-ua-platform: "macOS" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://test2.com Accept-Encoding: gzip, deflate, br Accept-Language: en,en-GB;q=0.9

[klammal]

Having the same issue with Java