Swagger-ui: 302 Redirects that aren't handled don't produce a clear error

[dblock]

I have a 302 redirect in the API and Swagger doesn't handle that. It's not its fault, CORS doesn't support this. You get "XMLHttpRequest cannot load URL. The request was redirected to URL, which is disallowed for corss-origin requests that require preflight."

Not sure whether Swagger can do anything about fixing this, however the error is not properly reported, it just looks like the API succeeded and didn't return a response.

[fehguy]

This is a design of CORS. We can improve the error messages, though.

[dblock]

:+1:

[carlskii]

Hi, Im seeing this problem too!

Are there any workarounds for this ?

[fehguy]

redirects are now handled automatically, however CORS issues when switching protocols or hosts are not.

[mohsen1]

CORS issue can't be solved. JavaScript can never know if a cross origin error was thrown.

[tperlmutter]

I realize this is closed, but the solution is fairly straightforward, it also points out a limitation of using curl in swagger-ui (see the followup below).

Just a note that I'm using Camel here...

If you already have a method somewhere to add the CORS headers, then don't use:

    HttpServletResponse response = exchange.getIn().getBody(HttpServletResponse.class);
    response.sendRedirect(url);
    addCorsHeaders(exchange);   // a method that does this

Doing this will signal your processing to actually strip out all headers but Location and Content-Length (I think the latter, definitely the former). Instead, handle it manually like this:

        HttpServletResponse response = exchange.getIn().getBody(HttpServletResponse.class);
        response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY);
        exchange.getIn().setHeader(HttpHeaders.LOCATION, url);
        addCorsHeaders(exchange);   // a method that does this

If you do this then swagger-ui will play nice... sort of, it won't show the 302, because curl will just return the response from the redirect, which in theory will return a 200, so that's what you'll see. Which is sort of what a web browser does, but it's smart enough to note the new URL and the 302 and the 200 - which swagger-ui is not. But that might be because curl obfuscates it.

[dblock]

@tperlmutter If you can PR a fix for this that would be amazing!

[tperlmutter]

I honestly didn't track down why sendRedirect() strips out all other headers, I just know that it's the culprit and the above is the workaround.

[gsbtech]

I tried the response above, setting Location header for a 303 response, where the Location had a different server name than the incoming request.
It worked with curl, and chrome POSTMAN, but swagger failed.
I added a combination of CORS headers, still did not worked.Using springfox-swagger2/springfox-swagger-ui 2.6.1 and spring 4.2.5.RELEASE.
Is there a set of CORS headers I need to include?

[arlan85]

Did anyone knows about this issue? I'm facing the same issue with CORS:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://login.microsoftonline.com/key/oauth2/authorize?client_id=client_id&redirect_uri=https%3A%2F%2Flocalhost%3A4409%2Fsignin-oidc

[shockey]

@arlan85, if you're still having a problem, please open a new issue 😄