Question 175160 in Apache Question posted in
Some documentation to get you started can be found here.

What is the purpose of life?

I’m running into an issue with my dispatcher CORS configurations, debugging this is proving out to be insanely challenging.

Env –

AEM as cloud service. There are a couple of content fragment model APIs that a web app is consuming. The web app has 3 non-prod environments, each with its own domain and all three domains are hitting the same aem instance to consume model APIs.

Issue –

CORS response caches only the first requester (say domain1.com) until cache expiry. Subsequent CORS requests from other origins (say domain2.com and domain3.com) fail since the cached origin is different to the current requester’s origin (even though they are an ‘allowed origin’ under our policy).

Access to XMLHttpRequest at
‘https://publish-p12345-e12345.adobeaemcloud.com/content/wknd/us/en/api/experiments.model.json’ from origin ‘https://domain2.com’ has been blocked by CORS policy: The
‘Access-Control-Allow-Origin’ header has a value ‘https://domain1.com’
that is not equal to the supplied origin.

AEM setup –

  1. OSGi config (com.adobe.granite.cors.impl.CORSPolicyImpl)
{
  "allowedpaths": [".*"],
  "alloworigin": ["https://domain1.com","https://domain2.com","https://domain3.com"],
  "alloworiginregexp": [],
  "exposedheaders": [],
  "maxage:Integer": 1800,
  "supportedheaders": ["Origin","Accept","X-Requested-With","Content-Type","Access-Control-Request-Method","Access-Control-Request-Headers"],
  "supportedmethods": ["HEAD","GET"],
  "supportscredentials": false
}
  1. /conf.d/available_vhosts/wknd.vhost
<Directory />
....
Header merge Vary Origin
....
</Directory>

<IfModule mod_headers.c>
# Multi domain CORS support
SetEnvIfNoCase Origin "https?://(www.)?(domain1.com|domain2.com|domain3.com)(:d+)?$" ACAO=$0
Header set Access-Control-Allow-Origin %{ACAO}e env=ACAO
Header set Vary Origin

<LocationMatch ".(json)$">
Header set Cache-Control "max-age=600,stale-while-revalidate=86400,stale-if-error=86400" "expr=%{REQUEST_STATUS} < 400"
Header set Age 0
</LocationMatch>
</IfModule>

Also tried,

  • removing the Vary Origin lines
  • Header always add Access-Control-Allow-Origin
    , all to no avail.
  1. Not caching any CORS headers in conf/dispatcher.d/available_farms/wknd.farm/publishfarm/headers
/headers {
 "Cache-Control"
 "Content-Disposition"
 "Content-Type"
 "Expires"
 "Last-Modified"
 "X-Content-Type-Options"
 "Surrogate-Control"
}
  1. Adding access-control headers to conf/dispatcher.d/clientheaders
$include "./default_clientheaders.any"
"Origin"
"Access-Control-Request-Method"
"Access-Control-Request-Headers"

Can someone who has tackled this in the past guide here please ?

Tags:

2

Answers


  1. 0

    I am dealing with the exact same issue with CORS requests at the moment and have read on several similar forums that the subsequent requests get blocked. Have you tried to remove the OSGI configuration and just run the vhost configuration alone? It’s possible that the two configurations are conflicting each other.

    Login or Signup to reply.
  2. 0

    This is the setup that I have working for multiple cors domains requesting same resource

    1. Disable browser caching for resources that are to be requested cross-origin – there is no other way.
    setenvif request_uri ^/content/mysite/cors/(.).(html|json) cors
Header Set Cache-Control "max-age=0, no-cache, no-store" env=cors
    1. On dispatcher rewrite filename with another selector that specifies the origin. so requests from each origin get cached separately-
    rewritecond %{http:origin} ^https://(.*).mysite.com
rewriterule ^/content/mysite/(.*).(html|json) /content/mysite/$1.cors-%1.$2 [PT]

//this rewrites /content/mysite/abc.html to /content/mysite/abc.cors-domain.html
    1. on AEM add a sling mapping to remove the additional selector added by dispatcher
    /etc/map.publish/https/www.mysite.com/mysite-cors
    +sling:match="content/mysite/(.*).cors-(.*).(html|json)"
    +sling:internalRedirect="/content/cors/$1.$3"

//this rewrites /content/cors/abc.cors-domain.html back to /content/cors/abc.html which then gets processed by AEM.
    1. add a new cors policy osgi config for each cors domain. no need to mix domains in config.
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search