Docker部署Elasticsearch开启CORS后无法连接的解决方案咨询

问题根源 #

你遇到的连接拒绝问题，核心原因是**http.cors.allow-credentials: 'true'与http.cors.allow-origin: "*"的配置冲突**——根据CORS规范，当允许携带凭证（credentials）时，allow-origin不能设为通配符*，Elasticsearch会因这个无效配置启动失败，导致连接被拒绝。

两种可行配置方案 #

根据你的开发需求，选择以下任意一种配置：

方案1：无需凭证（开发环境最小安全） #

如果你的WordPress插件不需要向Elasticsearch发送带凭证的请求，可直接关闭凭证允许，同时保留任意来源的CORS权限：

services:
  elasticsearch:
    image: elasticsearch:8.7.1
    ports:
      - 9200:9200
    environment:
      discovery.type: single-node
      ES_JAVA_OPTS: '-Xms256m -Xmx256m'
      network.bind_host: 0.0.0.0
      xpack.security.enabled: 'false'
      # 修正后的CORS配置
      http.cors.enabled: 'true'
      http.cors.allow-origin: "*"
      http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
      http.cors.allow-headers: X-Requested-With, X-Auth-Token, Content-Type, Content-Length, Authorization, Access-Control-Allow-Headers, Accept
      http.cors.allow-credentials: 'false'  # 关闭凭证允许，避免与*冲突
    volumes:
      - esdata:/usr/share/elasticsearch/data
    networks:
      - internal
      - elastic

volumes:
  esdata:
networks:
  elastic:
    external: true
  internal:
    driver: bridge

方案2：需要凭证（兼容任意来源） #

如果插件必须发送带凭证的请求，可将allow-origin设为正则表达式/.*/（匹配任意来源），同时保留凭证允许：

services:
  elasticsearch:
    image: elasticsearch:8.7.1
    ports:
      - 9200:9200
    environment:
      discovery.type: single-node
      ES_JAVA_OPTS: '-Xms256m -Xmx256m'
      network.bind_host: 0.0.0.0
      xpack.security.enabled: 'false'
      # 兼容凭证的CORS配置
      http.cors.enabled: 'true'
      http.cors.allow-origin: "/.*/"  # 用正则匹配任意来源，替代*
      http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
      http.cors.allow-headers: X-Requested-With, X-Auth-Token, Content-Type, Content-Length, Authorization, Access-Control-Allow-Headers, Accept
      http.cors.allow-credentials: 'true'
    volumes:
      - esdata:/usr/share/elasticsearch/data
    networks:
      - internal
      - elastic

volumes:
  esdata:
networks:
  elastic:
    external: true
  internal:
    driver: bridge

操作步骤 #

1. 停止并清理现有Elasticsearch容器与数据卷（避免旧配置残留）：

   docker-compose down -v
   

2. 将上述修改后的配置覆盖原docker-compose.yml
3. 重新启动容器：

   docker-compose up -d
   

4. 验证CORS配置生效：

   curl -I http://localhost:9200
   

   响应头中应包含Access-Control-Allow-Origin字段。

内容的提问来源于stack exchange，提问作者Javerleo