Istio CorsPolicy未按预期返回access-control-allow-*响应头问题

问题结论 #

你遇到的这种行为并非Istio的预期行为，属于Istio在CORS策略执行上的漏洞：预检请求不匹配Origin时返回错误的宽松响应头，实际请求完全不校验Origin直接回传，这违背了配置CORS策略的安全初衷。

拦截未被允许源的解决方法 #

仅依赖CorsPolicy无法实现严格的源拦截，需结合请求匹配规则或授权策略强制校验Origin：

方法1：在VirtualService中添加Origin匹配规则

修改现有VirtualService，为目标路由添加Origin匹配条件，仅允许指定源的请求通过，其余请求直接返回403：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin-ext-vs
spec:
  hosts:
  - httpbin.org
  gateways:
  - httpbin-ext-gateway
  http:
  - match:
    - gateways:
      - httpbin-ext-gateway
      port: 80
      uri:
        prefix: /status
      headers:
        origin:
          exact: https://example.com
    route:
    - destination:
        host: httpbin.org
        port:
          number: 80
    corsPolicy:
      allowOrigins:
      - exact: https://example.com
      allowMethods:
      - POST
      - GET
      allowCredentials: false
      allowHeaders:
      - X-Foo-Bar
      maxAge: "1m"
  # 拦截所有不匹配的请求
  - match:
    - gateways:
      - httpbin-ext-gateway
      port: 80
      uri:
        prefix: /status
    fault:
      abort:
        httpStatus: 403
        percentage:
          value: 100.0

方法2：使用Istio AuthorizationPolicy全局拦截

创建授权策略，针对入口网关的目标路径校验Origin头，仅允许指定值的请求通过：

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: cors-origin-authz
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  action: ALLOW
  rules:
  - from:
    - source:
        requestHeaders:
          origin:
            exact: https://example.com
    to:
    - operation:
        hosts: ["httpbin.org"]
        paths: ["/status/*"]
  # 拒绝其他所有匹配该路径的请求
  - action: DENY
    to:
    - operation:
        hosts: ["httpbin.org"]
        paths: ["/status/*"]

验证效果 #

配置生效后，未授权Origin发起的预检或实际请求会直接返回403 Forbidden，彻底阻止未被允许的源调用。

内容的提问来源于stack exchange，提问作者Raja Kumar Thiruvasagam