How to enable cors

[RudyBone]

I'm using version 1.8.0. looking for a clear example of how to enable cors in the ingress.yaml

[pleshakov]

Hi @RudyBone

We don't have built-in support for CORS. However, it is something that could be added via snippets.

I suggest taking a look at this example https://enable-cors.org/server_nginx.html and adding those parts to your Ingress resource via nginx.org/location-snippets annotation. See also https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-snippets/

[FossPrime]

// apiVersion: extensions/v1beta1, kind: Ingress
// metadata.annotations
nginx.org/location-snippets: |
      add_header Access-Control-Allow-Origin "*";
      add_header Access-Control-Allow-Methods GET;
      add_header Access-Control-Expose-Headers "Content-Length,Content-Range";

[brianehlert]

This can also be achieved using the VirtualServer resource by applying a location-snippet
(location-snippet is applied in both cases)

https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#using-snippets

[jmozd]

is there a reason such "support" is not included in the upstream templates, conditionally applied if an according annotation is present on the ingress?

While the actual NGINX configuration statements to be used to enable CORS may need detailed discussion (I'm definitely no NGINX expert, and found a different statement to work for me), the change to apply them if some annotation is present seem to be "a piece of cake". So I'm wondering if it's just that nobody found time for an according PR - or if there's some other reason behind it, making it more complicated than I currently can oversee?

[brianehlert]

Quite frankly, an 'easy button' style setting for CORS has not been historically prioritized. From the information we have, it is not the majority of customers.
That said, there is also more than one way to enable CORS with NGINX. Different header options for different folks.
The project is always open to PRs for anyone willing to invest.

[jmozd]

#3004 is what I have in place, as a first shot. Working for me in my specific environment, but will need some additions for a more generalized solution (like adding "Access-Control-Allow-Methods").

[brianehlert]

We also have an old PR that was not completed.
The suggestion to complete the implementation was based on the settings described here: https://enable-cors.org/server_nginx.html

The relative comment in the abandoned PR is here: #144 (comment)