CORS Filter

Cross-Origin Resource Sharing (CORS) is a method of enforcing client-side access controls on resources by specifying external domains that are able to access certain or all routes of your domain. Browsers use the presence of HTTP headers to determine if a response from a different origin is allowed.

To help demonstrate how front-envoy can enforce CORS policies, we are releasing a set of docker compose sandboxes that deploy a frontend and backend service on different origins, both behind front-envoy.

The frontend service has a field to input the remote domain of your backend service along with radio buttons to select the remote domain’s CORS enforcement. The CORS enforcement choices are:

  • Disabled: CORS is disabled on the route requested. This will result in a client-side CORS error since the required headers to be considered a valid CORS request are not present.

  • Open: CORS is enabled on the route requested but the allowed origin is set to *. This is a very permissive policy and means that origin can request data from this endpoint.

  • Restricted: CORS is enabled on the route requested and the only allowed origin is envoyproxy.io. This will result in a client-side CORS error.

Running the Sandboxes

The following documentation runs through the setup of Envoy described above.

Step 1: Install Docker

Ensure that you have a recent versions of docker and docker-compose installed.

A simple way to achieve this is via the Docker Desktop.

Step 2: Clone the Envoy repo

If you have not cloned the Envoy repo, clone it with:

SSH

HTTPS

  1. git clone git@github.com:envoyproxy/envoy
  1. git clone https://github.com/envoyproxy/envoy.git

Step 3: Start all of our containers

Switch to the frontend directory in the cors example, and start the containers:

  1. $ pwd
  2. envoy/examples/cors/frontend
  3. $ docker-compose pull
  4. $ docker-compose up --build -d
  5. $ docker-compose ps
  7.           Name                          Command              State                            Ports
  8. ------------------------------------------------------------------------------------------------------------------------------
  9. frontend_front-envoy_1        /docker-entrypoint.sh /bin ... Up      10000/tcp, 0.0.0.0:8000->8000/tcp, 0.0.0.0:8001->8001/tcp
  10. frontend_frontend-service_1   /bin/sh -c /usr/local/bin/ ... Up      10000/tcp, 8000/tcp

Now, switch to the backend directory in the cors example, and start the containers:

  1. $ pwd
  2. envoy/examples/cors/backend
  3. $ docker-compose pull
  4. $ docker-compose up --build -d
  5. $ docker-compose ps
  7.           Name                         Command             State                            Ports
  8. ----------------------------------------------------------------------------------------------------------------------------
  9. backend_backend-service_1   /bin/sh -c /usr/local/bin/ ... Up      10000/tcp, 8000/tcp
  10. backend_front-envoy_1       /docker-entrypoint.sh /bin ... Up      10000/tcp, 0.0.0.0:8002->8000/tcp, 0.0.0.0:8003->8001/tcp

Step 4: Test Envoy’s CORS capabilities

You can now open a browser to view your frontend service at http://localhost:8000.

Results of the cross-origin request will be shown on the page under Request Results.

Your browser’s CORS enforcement logs can be found in the browser console.

For example:

  1. Access to XMLHttpRequest at 'http://192.168.99.100:8002/cors/disabled' from origin 'http://192.168.99.101:8000'
  2. has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Step 5: Check stats of backend via admin

When Envoy runs, it can listen to admin requests if a port is configured.

In the example configs, the backend admin is bound to port 8003.

If you browse to http://localhost:8003/stats you will be able to view all of the Envoy stats for the backend. You should see the CORS stats for invalid and valid origins increment as you make requests from the frontend cluster.

  1. http.ingress_http.cors.origin_invalid: 2
  2. http.ingress_http.cors.origin_valid: 7