部署在Google Cloud App Engine的Vert.x如何配置CORS？

我正尝试将Vert.x后端部署到Google Cloud的App Engine，部署完成后无法正常访问，核心问题是CORS错误。后端包含两个核心文件：SamlVerticle.java（部署的verticle）和SamlHandlers.java（路由处理器）。

SamlVerticle.java 代码 #

public void start(Promise<Void> startPromise) throws Exception {
    System.out.println("SAML Verticle Started");
    Router router = Router.router(vertx);

    // CORS Handler
    // router.route().handler(CorsHandler.create(SamlConstants.FRONTEND_URL_PROD));
    router.route().handler(SamlHandlers.handlerCheckCorsHeaders());
    router.route().method(HttpMethod.OPTIONS).handler(SamlHandlers.handlerOptionsMethod());

    // BodyHandler is used to parse the request body into a RequestBody object.
    router.route().handler(BodyHandler.create());

    router.get("/").handler(SamlHandlers.getBaseHandler());
    
    // ...other handlers and server creation on port 8080
}

另一种CORS配置尝试 #

router
    .route()
    .handler(
        CorsHandler.create("*")
            .allowedMethod(HttpMethod.GET)
            .allowedMethod(HttpMethod.POST)
            .allowedMethod(HttpMethod.OPTIONS)
            .allowedHeader("Access-Control-Request-Method")
            .allowedHeader("Access-Control-Allow-Methods")
            .allowedHeader("Access-Control-Allow-Origin")
            .allowedHeader("Access-Control-Allow-Headers")
            .allowedHeader("Content-Type"));

SamlHandlers.java 代码 #

public static Handler<RoutingContext> handlerCheckCorsHeaders() {
    return context -> {
      final HttpServerResponse response = context.response();
      final String origin = context.request().getHeader("Origin");

      if (origin != null && origin.equals(SamlConstants.FRONTEND_URL_PROD)) {
        response.putHeader("Access-Control-Allow-Origin", origin);
        response.putHeader("Vary", "Origin");
      }
      context.next();
    };
}

public static Handler<RoutingContext> getBaseHandler() {
    return context -> {
      context.response().end("Simple Response");
    };
}

public static Handler<RoutingContext> handlerOptionsMethod() {
    return context -> {
      final HttpServerResponse response = context.response();
      final String origin = context.request().getHeader("Origin");

      if (origin != null && origin.equals(SamlConstants.FRONTEND_URL_PROD)) {
        response.putHeader("Access-Control-Allow-Origin", origin);
        response.putHeader(
            "Access-Control-Allow-Methods", "OPTIONS, GET, POST, PUT, PATCH, HEAD, DELETE");

        response.putHeader("Access-Control-Allow-Headers", "Content-Type, Accept, Authorization");
      } else {
        // Consider returning a more informative error message
        response.setStatusCode(403).end("Forbidden");
      }
      // Your available methods might vary!
      context.end("OPTIONS, GET, POST, PUT, PATCH, HEAD, DELETE");
    };
}

// ...other handlers

问题现象 #

所有配置在本地运行正常，无需预检请求，但部署到App Engine后频繁出现CORS错误。

前端控制台日志 #

Access to fetch at /some/api from origin has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

前端网络标签页错误情况 #

• 有时出现单个CORS错误
• 有时出现另一种CORS错误（取决于当前运行的配置）
• 其他时候出现两个请求错误：
  • OPTIONS预检请求返回503错误
  • 实际请求因预检失败报错

已尝试多种请求头配置均无效，怀疑遗漏了App Engine的特定设置。

内容的提问来源于stack exchange，提问作者Vansh Sharma