通过KrakenD网关发送OPTIONS请求时遭遇HTTP 405错误求助

问题现象 #

通过KrakenD API网关向/apexadapter/version端点发送OPTIONS请求时，始终返回HTTP 405 Method Not Allowed错误；直接访问后端API服务器的该资源则正常。已按官方文档在全局extra_config中配置了security/cors，但响应头中无任何Access-Control-Allow-*字段，响应内容被剥离。

模拟请求命令 #

curl --location --request OPTIONS 'http://localhost:30000/apexadapter/version'

当前KrakenD配置 #

{
  "version": 2,
  "timeout": "15m",
  "cache_ttl": "300s",
  "output_encoding": "json",
  "name": "apexadapter",
  "extra_config": {
    "security/cors": {
      "allow_origins": ["*"],
      "allow_methods": ["GET", "HEAD", "POST", "OPTIONS", "PATCH", "DELETE"],
      "debug": true
    }
  },
  "endpoints": [
    {
      "endpoint": "/apexadapter/version",
      "method": "GET",
      "output_encoding": "no-op",
      "backend": [{
        "url_pattern": "/version",
        "method": "GET",
        "encoding": "no-op",
        "host": [
          "http://apexadapter.apex.svc.cluster.local:38295"
        ]
      }]
    },
   ... 其他端点配置
}

Postman测试结果 #

OPTIONS http://localhost:30000/apexadapter/version: {
  "Network": {
    "addresses": {
      "local": {
        "address": "::1",
        "family": "IPv6",
        "port": 51269
      },
      "remote": {
        "address": "::1",
        "family": "IPv6",
        "port": 30000
      }
    }
  },
  "Request Headers": {
    "user-agent": "PostmanRuntime/7.29.2",
    "accept": "*/*",
    "cache-control": "no-cache",
    "postman-token": "bf91c1ff-85fe-41e1-ad17-33afee354b2c",
    "host": "localhost:30000",
    "accept-encoding": "gzip, deflate, br",
    "connection": "keep-alive"
  },
  "Response Headers": {
    "content-type": "text/plain",
    "date": "Fri, 12 Aug 2022 19:40:38 GMT",
    "content-length": "22"
  },
  "Response Body": "405 method not allowed"
}

问题根源 #

KrakenD的路由逻辑优先于CORS中间件：

1. 每个端点必须显式声明支持的请求方法，未声明的方法会被路由层直接拒绝并返回405。当前/apexadapter/version仅声明了GET方法，OPTIONS请求不在允许列表内。
2. CORS中间件只有在请求通过路由层校验后才会触发，若请求被路由层拒绝（405），CORS相关响应头根本不会被注入。

解决步骤 #

1. 为目标端点添加OPTIONS方法支持 #

修改端点配置，将method字段改为数组形式，包含GET和OPTIONS：

{
  "endpoint": "/apexadapter/version",
  "method": ["GET", "OPTIONS"],
  "output_encoding": "no-op",
  "backend": [{
    "url_pattern": "/version",
    "method": "GET",
    "encoding": "no-op",
    "host": [
      "http://apexadapter.apex.svc.cluster.local:38295"
    ]
  }]
}

注：OPTIONS是预检请求，KrakenD会自动处理，无需配置对应的backend方法转发到后端。

2. 完善全局CORS配置（可选） #

补充必要的头信息以支持完整的跨域场景：

"security/cors": {
  "allow_origins": ["*"],
  "allow_methods": ["GET", "HEAD", "POST", "OPTIONS", "PATCH", "DELETE"],
  "allow_headers": ["Content-Type", "Authorization"],
  "expose_headers": ["Content-Length"],
  "debug": true
}

3. 验证配置并重启服务 #

使用KrakenD自带的校验工具检查配置语法：

krakend check -t krakend.json

确认配置无误后重启KrakenD服务，再次测试OPTIONS请求即可正常返回CORS响应头。

内容的提问来源于stack exchange，提问作者RobbieS