Repository navigation
In Druid 0.12 there is no endpoint for OPTIONS queries. Thus it is impossible to run CORS queries. #5588
Description
We receive such HTTP query errors (403 return code):
Request did not have an authorization check performed.: {class=io.druid.server.security.PreResponseAuthorizationCheckFilter, uri=/druid/v2/, method=OPTIONS)
While running CORS HTTP POST query, there is a pre-flight request which is of OPTION type.
Is is missing @options endpoint in QueryResource class
Activity
dylwylie commentedon Apr 6, 2018
The following extensions exists which I believe will enable CORS -> https://github.com/acesinc/druid-cors-filter-extension
Although I'm not sure that it's a common use case because of the security implications of querying Druid directly from the browser.
gianm commentedon Apr 6, 2018
I presume this worked before (the handling must be built into Jetty)?
mkuthan commentedon Apr 6, 2018
It worked on version 0.10 with some headers modification on load balancer in front of druid brokers. Load balancer is configured to add CORS headers to all responses so the cors-filter-extension is not needed.
In version 0.12 there is a new PreResponseAuthorizationCheckFilter in the end of filters chain. It checks for AuthConfig.DRUID_AUTHORIZATION_CHECKED servlet context attribute and if the attribute is not set - returns 403.
The problem is that for OPTIONS request there is no handler responsible for setting servlet attribute AuthConfig.DRUID_AUTHORIZATION_CHECKED. Even if the security is not enabled at all.