Configuring CORS

Security
6

I finally figured it out. Two things you need to pay attention:

  1. You need to add the allowed origins in the allowOrigins field.
  2. You need to specify the “Origin” header in the curl command to indicate that it’s a cors request.

Otherwise, the access-control-allow-* headers won’t show up.
For instance:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
 name: cors-rule
spec:
 hosts:
 - http-server.default.svc.cluster.local
 http:
 - route:
   - destination:
       host: http-server.default.svc.cluster.local
   corsPolicy:
     allowOrigins:
     - exact: http://www.example.com
     allowMethods:
     - POST
     - GET
     allowHeaders:
     - X-Custom-Header
     exposeHeaders:
     - X-Expose-Header
     maxAge: 24h
     allowCredentials: false

k exec http-server-6cc8fd5c68-cnp9h - curl -sv -H “Origin: http://www.example.com” http-server.default.svc.cluster.local/test

1 Like