本地运行CORS Headers正常，Traefik代理后Headers丢失问题排查

问题背景 #

• 采用Go语言搭配Chi路由构建后端服务，Traefik作为反向代理
• 本地单独运行Docker容器（端口8000）时，CORS Headers及自定义Header均可正常返回
• 通过Droplet上的Traefik代理访问时，接口数据正常，但CORS Headers和自定义Header全部丢失
• 已通过Traefik配置手动设置CORS Headers解决CORS相关问题，但Go代码中设置的自定义Header仍被过滤（如OAuth JWT令牌场景，本地正常、代理后Header被拦截）

相关代码文件 #

server.go #

// server.go
package server

import (
    "encoding/json"
    "net/http"

    "github.com/go-chi/chi/v5"
    "github.com/go-chi/chi/v5/middleware"
    "github.com/go-chi/cors"
    "github.com/go-chi/render"
)

func (s *Server) RegisterRoutes() http.Handler {
    r := chi.NewRouter()
    r.Use(cors.Handler(cors.Options{
        AllowedOrigins:   []string{"https://my-deployment-url.netlify.app", "http://localhost:3000"},
        AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "HEAD"},
        AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
        ExposedHeaders:   []string{"Link"},
        AllowCredentials: true,
        MaxAge:           300,
    }))
    r.Use(middleware.Logger)

    r.Get("/", s.IndexHandler)

    return r
}

func (s *Server) IndexHandler(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("X-Test-Header", "TestHeaderValue")
    resp := map[string]string{
        "message": "Route 2",
    }

    render.JSON(w, r, resp)
}

compose.yaml（初始配置） #

# compose.yaml
services:
  reverse-proxy:
    image: traefik:v3.1
    command:
      - "--providers.docker"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=my-email@gmail.com"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - letsencrypt:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock
  goapp:
    container_name: go
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.kanjoy.rule=Host(`my-deployment-url`)"
      - "traefik.http.routers.kanjoy.entrypoints=websecure"
      - "traefik.http.routers.kanjoy.tls.certresolver=myresolver"
    build:
      context: .
      dockerfile: Dockerfile.prod
    volumes:
      - ./:/app
    depends_on:
      - db
  db:
    image: postgres:latest
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${BLUEPRINT_DB_DATABASE}
      POSTGRES_USER: ${BLUEPRINT_DB_USERNAME}
      POSTGRES_PASSWORD: ${BLUEPRINT_DB_PASSWORD}
    ports:
      - "${BLUEPRINT_DB_PORT}:5432"
    volumes:
      - db:/var/lib/postgresql/data

volumes:
  db:
  letsencrypt:

更新内容（CORS问题解决） #

通过在compose.yaml中为Go服务添加Traefik CORS中间件配置，暂时解决了CORS问题：

- "traefik.http.routers.to_kanjoy.middlewares=cors"
      - "traefik.http.middlewares.cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT,POST,DELETE,PATCH"
      - "traefik.http.middlewares.cors.headers.accesscontrolallowheaders=Content-Type,
        Authorization, X-Requested-With"
      - "traefik.http.middlewares.cors.headers.accesscontrolallowcredentials=true"
      - "traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist=https://my-deployment-url.netlify.app,http://localhost:3000"
      - "traefik.http.middlewares.cors.headers.accesscontrolmaxage=100"
      - "traefik.http.middlewares.cors.headers.addvaryheader=true"

当前遗留问题 #

Go代码中设置的自定义Header（如示例中的X-Test-Header）仍被Traefik过滤，本地运行容器时Header正常返回，通过服务器端Traefik代理访问时Header丢失。

内容的提问来源于stack exchange，提问作者Zev Ross