(shenyu) branch master updated: fix(web): continue disallowed cors preflight chain (#7108)

[liuhongyu]

This is an automated email from the ASF dual-hosted git repository.

Aias00 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shenyu.git


The following commit(s) were added to refs/heads/master by this push:
     new 577c22ff27 fix(web): continue disallowed cors preflight chain (#7108)
577c22ff27 is described below

commit 577c22ff2707dcbbcdf4f34253091d3736a54235
Author: Liming Deng <liming.d....@gmail.com>
AuthorDate: Wed Sep 23 12:34:10 2026 +0800

    fix(web): continue disallowed cors preflight chain (#7108)
    
    Co-authored-by: aias00 <liuhon...@apache.org>
---
 .../org/apache/shenyu/web/filter/CrossFilter.java  |  8 ++---
 .../apache/shenyu/web/filter/CrossFilterTest.java  | 36 ++++++++++++++++++++++
 2 files changed, 40 insertions(+), 4 deletions(-)

diff --git 
a/shenyu-web/src/main/java/org/apache/shenyu/web/filter/CrossFilter.java 
b/shenyu-web/src/main/java/org/apache/shenyu/web/filter/CrossFilter.java
index 6d147dfe17..0aa4c6b074 100644
--- a/shenyu-web/src/main/java/org/apache/shenyu/web/filter/CrossFilter.java
+++ b/shenyu-web/src/main/java/org/apache/shenyu/web/filter/CrossFilter.java
@@ -112,10 +112,10 @@ public class CrossFilter implements WebFilter {
                 // "Access-Control-Allow-Credentials"
                 this.filterSameHeader(headers, 
HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS,
                         
String.valueOf(this.filterConfig.isAllowCredentials()));
-            }
-            if (request.getMethod() == HttpMethod.OPTIONS) {
-                response.setStatusCode(HttpStatus.OK);
-                return Mono.empty();
+                if (request.getMethod() == HttpMethod.OPTIONS) {
+                    response.setStatusCode(HttpStatus.OK);
+                    return Mono.empty();
+                }
             }
         }
         return chain.filter(exchange);
diff --git 
a/shenyu-web/src/test/java/org/apache/shenyu/web/filter/CrossFilterTest.java 
b/shenyu-web/src/test/java/org/apache/shenyu/web/filter/CrossFilterTest.java
index 699a0ad6c7..68172c0b1d 100644
--- a/shenyu-web/src/test/java/org/apache/shenyu/web/filter/CrossFilterTest.java
+++ b/shenyu-web/src/test/java/org/apache/shenyu/web/filter/CrossFilterTest.java
@@ -21,6 +21,7 @@ import 
org.apache.shenyu.common.config.ShenyuConfig.CrossFilterConfig;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.server.reactive.ServerHttpResponse;
 import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
 import org.springframework.mock.web.server.MockServerWebExchange;
@@ -33,6 +34,8 @@ import java.util.HashSet;
 import java.util.regex.Pattern;
 
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 /**
@@ -141,6 +144,39 @@ public final class CrossFilterTest {
                 .verifyComplete();
     }
 
+    @Test
+    public void testOptionsRequestFromDisallowedOriginContinuesFilterChain() {
+        ServerWebExchange exchange = 
MockServerWebExchange.from(MockServerHttpRequest
+                .options("http://localhost:8080";)
+                .header(HttpHeaders.ORIGIN, "http://disallowed.example";)
+                .build());
+        WebFilterChain chain = mock(WebFilterChain.class);
+        when(chain.filter(exchange)).thenReturn(Mono.empty());
+
+        StepVerifier.create(new CrossFilter(new 
CrossFilterConfig()).filter(exchange, chain))
+                .verifyComplete();
+
+        verify(chain).filter(exchange);
+        Assertions.assertNull(exchange.getResponse().getStatusCode());
+    }
+
+    @Test
+    public void testOptionsRequestFromAllowedOriginIsHandled() {
+        ServerWebExchange exchange = 
MockServerWebExchange.from(MockServerHttpRequest
+                .options("http://localhost:8080";)
+                .header(HttpHeaders.ORIGIN, "http://allowed.example";)
+                .build());
+        WebFilterChain chain = mock(WebFilterChain.class);
+        CrossFilterConfig filterConfig = new CrossFilterConfig();
+        filterConfig.setAllowedAnyOrigin(true);
+
+        StepVerifier.create(new CrossFilter(filterConfig).filter(exchange, 
chain))
+                .verifyComplete();
+
+        verify(chain, never()).filter(exchange);
+        Assertions.assertEquals(HttpStatus.OK, 
exchange.getResponse().getStatusCode());
+    }
+
     @Test
     public void testOriginRegex() {
         ServerWebExchange exchange = 
MockServerWebExchange.from(MockServerHttpRequest