Corsfilter fix by beepsoft · Pull Request #12151 · IQSS/dataverse

beepsoft · 2026-02-06T12:56:51Z

What this PR does / why we need it:

Fixes CorsFilter invocation inconsistency.

When accessing /api/... endpoints the CorsFilter was not always hit and so these endpoints could not be used from webapps even if CORS was properly configured.

The problem seemed to be with ApiRouter's forwarding mechanism from /api/... to /api/v1/...

Adding FORWARD dispatcher types to @WebFilter solves this.

Fix is based on this zulip thread:

https://dataverse.zulipchat.com/#narrow/channel/379673-dev/topic/CorsFilter.20Servlet.20Filter.20not.20discovered/near/572358009

Also fixes #12161 with docs changes made by @poikilotherm originally as PR #12162 . Preview doc changes here: https://dataverse-guide--12151.org.readthedocs.build/en/12151/installation/config.html#cross-origin-resource-sharing-cors

Suggestions on how to test this:

CorsIT.java is added to test whether CORS headers are present for both /api/... and /api/v1/... invocations. For it to pass CORS must be enabled in Dataverse, eg. by setting

DATAVERSE_CORS_ORIGIN: "*"

env for dev_dataverse in docker-compose-dev.yml

coveralls · 2026-02-06T13:10:48Z

coverage: 24.323%. remained the same
when pulling 36c336e on beepsoft:cors-filter-fix
into 86796a1 on IQSS:develop.

pdurbin

A quick review.

ErykKul

Looks good to me. Thanks! Just a release note and it's ready.

beepsoft · 2026-02-09T09:27:41Z

@ErykKul Should I just add doc/release-notes/cors-filter-fix.md? I don't have an associated issue and so my branch name is not prefixed with the issue number, which seems to be required by the doc/release-notes/README.md

poikilotherm · 2026-02-11T21:08:36Z

@beepsoft Please feel free to create an issue and link this PR to it. Can be brief.

Also, I see Jenkins is not happy with one IT: [ERROR] Failures: ", "[ERROR] SwordIT.testDeleteFiles:961 1 expectation failed.", "Expected status code <200> but was <500>."

Can you please look into that? Thx!

Also, CorsIT must be added to https://github.com/IQSS/dataverse/blob/develop/tests/integration-tests.txt

beepsoft · 2026-02-12T13:47:50Z

Do we need an issue at this point? I only raised the issue question because the release note authoring README.md mentioned, but I don't know if and how that applies here.

Regarding SwordIT: I could not reproduce it locally.

I added CorsIT to integration-tests.txt.

poikilotherm · 2026-02-13T14:17:28Z

I see in https://jenkins.dataverse.org/blue/organizations/jenkins/IQSS-Dataverse-Develop-PR/detail/PR-12151/7/tests that the tests now run, but CorsIT fails - the headers are all not present.

I have a hunch that we might need @donsizemore to enable CORS during testing. Unfortunately, we currently have no way to change JVM options at runtime (there may exist an issue about this already).

@pdurbin WDYT should we disable these tests until we figure out the remote JVM option part? Can we just enable CORS in Jenkins without affecting other tests?

qqmyers · 2026-02-13T14:23:06Z

FWIW: I've recently started making non-IT tests with direct (mocked) calls to API methods to be able to test non-default JVM options, e.g. in LDNInboxTest.java and LocalContextsTest.java. Is that a useful approach here?

pdurbin · 2026-02-17T21:58:32Z

There seem to be some open questions and some failing tests and the PR is still in draft so I moved it from "ready for QA" to "ready for review".

pdurbin · 2026-02-24T15:19:42Z

@ErykKul Should I just add doc/release-notes/cors-filter-fix.md? I don't have an associated issue and so my branch name is not prefixed with the issue number, which seems to be required by the doc/release-notes/README.md

@beepsoft doc/release-notes/cors-filter-fix.md is fine. Also, please click "ready for review" (if you're ready), to take this PR out of draft.

srmanda-cs · 2026-04-08T22:15:50Z

https://jenkins.dataverse.org/job/IQSS-Dataverse-Develop-PR/job/PR-12151/16/testReport/

CorsIT tests pass, pipeline back to normal

beepsoft · 2026-04-10T09:31:13Z

Thank you all for the work you put into this. Sorry I couldn’t be involved over the past few weeks. Is there anything else I need to do on this, or can we go ahead and close the issue?

srmanda-cs · 2026-04-10T11:41:40Z

Thank you all for the work you put into this. Sorry I couldn’t be involved over the past few weeks. Is there anything else I need to do on this, or can we go ahead and close the issue?

Hi. Thank you for your work on this too! From my side, I would very strongly recommend you to rewrite the assertions for CorsIT as I mentioned in my earlier review. Installations like to run the test suites again, and if they set their CORS allowance policies to "*" then, CorsIT would fail and they wouldn't be able to figure out why. I know this because it is the exact same thing that happened with me ;)

Once again though, amazing work from everyone.

pdurbin · 2026-04-10T11:47:33Z

@beepsoft is CORS on or off by default as of this PR? Please see my confusion over the docs: #12151 (comment)

pdurbin · 2026-04-10T11:49:07Z

@beepsoft p.s. @srmanda-cs and I are talking here if you want to join: https://dataverse.zulipchat.com/#narrow/channel/379673-dev/topic/CorsFilter.20Servlet.20Filter.20not.20discovered/with/584443987

…elocate Big Data guide IQSS#12151 IQSS#12161

pdurbin

I zoomed with @poikilotherm and he resolved my remaining issues with the docs in 2cac1fe (thanks!). API tests are passing. (Heads up to @srmanda-cs that, like Jenkins, we'll need to configure containers to turn on CORS for the CORS IT tests to pass.) I'm approving this. Thanks, all!

poikilotherm · 2026-04-15T16:05:53Z

@pdurbin Why was this assigned back to us all? I'm not sure what's missing. I'm a bit puzzled what the goal is with Jenkins tests and all...

pdurbin · 2026-04-15T18:17:29Z

@pdurbin Why was this assigned back to us all? I'm not sure what's missing. I'm a bit puzzled what the goal is with Jenkins tests and all...

@poikilotherm please see #12151 (comment) and #dev > CorsFilter Servlet Filter not discovered @ 💬

beepsoft · 2026-04-16T08:52:11Z

@pdurbin Why was this assigned back to us all? I'm not sure what's missing. I'm a bit puzzled what the goal is with Jenkins tests and all...

The same applies to me. If there are any pending failures for @srmanda-cs or others in their environments, a fix is welcome, but I cannot commit to checking all possible test environments. This issue was supposed to be just about five lines of changes in CorsFilter.java 🙂

Due to our test infrastructure, it's not easy to do assertions on the content of the headers. Also, for the issue fixed in the CORS filter, this test doesn't need to check the content, just make sure they are present.

pdurbin · 2026-04-16T12:06:44Z

@beepsoft the conversation is happening here: https://dataverse.zulipchat.com/#narrow/channel/379673-dev/topic/CorsFilter.20Servlet.20Filter.20not.20discovered/near/585851791

@poikilotherm seems to have pushed a fix at ed07f96 so I'm unassigning you, @beepsoft.

poikilotherm · 2026-04-16T12:57:27Z

@pdurbin Jenkins is happy now, the CI env is no longer interfering. Took Ash and myself off. IMHO this is ready for QA unless you see something else.

@srmanda-cs

@srmanda-cs said I could dismiss his review at https://dataverse.zulipchat.com/#narrow/channel/379673-dev/topic/CorsFilter.20Servlet.20Filter.20not.20discovered/near/585903599 (all the fixes he wanted are now in).

poikilotherm reviewed Feb 6, 2026

View reviewed changes

Comment thread src/test/java/edu/harvard/iq/dataverse/api/CorsIT.java Outdated

poikilotherm reviewed Feb 6, 2026

View reviewed changes

Comment thread src/test/java/edu/harvard/iq/dataverse/api/CorsIT.java Outdated

poikilotherm reviewed Feb 6, 2026

View reviewed changes

Comment thread src/main/java/edu/harvard/iq/dataverse/filter/CorsFilter.java Outdated

poikilotherm added this to Forschungszentrum Jülich and IQSS Dataverse Project Feb 6, 2026

poikilotherm moved this to WIP in Forschungszentrum Jülich Feb 6, 2026

poikilotherm requested review from ErykKul and qqmyers February 6, 2026 14:46

poikilotherm marked this pull request as draft February 6, 2026 14:46

pdurbin reviewed Feb 6, 2026

View reviewed changes

Comment thread src/main/java/edu/harvard/iq/dataverse/filter/CorsFilter.java

ErykKul approved these changes Feb 9, 2026

View reviewed changes

cmbz added the FY26 Sprint 16 FY26 Sprint 16 (2026-01-28 - 2026-02-11) label Feb 11, 2026

poikilotherm moved this from WIP to Important in Forschungszentrum Jülich Feb 11, 2026

cmbz added the FY26 Sprint 17 FY26 Sprint 17 (2026-02-11 - 2026-02-25) label Feb 11, 2026

poikilotherm reviewed Feb 13, 2026

View reviewed changes

Comment thread tests/integration-tests.txt Outdated

pdurbin moved this from Ready for QA ⏩ to Ready for Review ⏩ in IQSS Dataverse Project Feb 17, 2026

cmbz added the FY26 Sprint 21 FY26 Sprint 21 (2026-04-08 - 2026-04-22) label Apr 8, 2026

pdurbin assigned beepsoft and unassigned donsizemore Apr 9, 2026

docs(cors): clarify CORS filter behavior, expand documentation, and r…

2cac1fe

…elocate Big Data guide IQSS#12151 IQSS#12161

pdurbin approved these changes Apr 14, 2026

View reviewed changes

github-project-automation Bot moved this from In Review 🔎 to Ready for QA ⏩ in IQSS Dataverse Project Apr 14, 2026

pdurbin unassigned pdurbin, beepsoft and poikilotherm Apr 14, 2026

pdurbin moved this from Ready for QA ⏩ to In Review 🔎 in IQSS Dataverse Project Apr 15, 2026

pdurbin assigned beepsoft, poikilotherm and srmanda-cs Apr 15, 2026

test(cors): simplify CorsIT to only assert presence of headers

ed07f96

Due to our test infrastructure, it's not easy to do assertions on the content of the headers. Also, for the issue fixed in the CORS filter, this test doesn't need to check the content, just make sure they are present.

pdurbin unassigned beepsoft Apr 16, 2026

poikilotherm unassigned poikilotherm and srmanda-cs Apr 16, 2026

pdurbin moved this from In Review 🔎 to Ready for QA ⏩ in IQSS Dataverse Project Apr 16, 2026

cmbz added the FY26 Sprint 22 FY26 Sprint 22 (2026-04-22 - 2026-05-06) label Apr 22, 2026

Conversation

beepsoft commented Feb 6, 2026 • edited by pdurbin Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coveralls commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pdurbin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ErykKul left a comment

Choose a reason for hiding this comment

Uh oh!

beepsoft commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

poikilotherm commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

beepsoft commented Feb 12, 2026

Uh oh!

Uh oh!

poikilotherm commented Feb 13, 2026

Uh oh!

qqmyers commented Feb 13, 2026

Uh oh!

pdurbin commented Feb 17, 2026

Uh oh!

pdurbin commented Feb 24, 2026

Uh oh!

srmanda-cs commented Apr 8, 2026

Uh oh!

beepsoft commented Apr 10, 2026

Uh oh!

srmanda-cs commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pdurbin commented Apr 10, 2026

Uh oh!

pdurbin commented Apr 10, 2026

Uh oh!

pdurbin left a comment

Choose a reason for hiding this comment

Uh oh!

poikilotherm commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pdurbin commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

beepsoft commented Apr 16, 2026

Uh oh!

pdurbin commented Apr 16, 2026

Uh oh!

poikilotherm commented Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

beepsoft commented Feb 6, 2026 •

edited by pdurbin

Loading

coveralls commented Feb 6, 2026 •

edited

Loading

beepsoft commented Feb 9, 2026 •

edited

Loading

poikilotherm commented Feb 11, 2026 •

edited

Loading

srmanda-cs commented Apr 10, 2026 •

edited

Loading

poikilotherm commented Apr 15, 2026 •

edited

Loading

pdurbin commented Apr 15, 2026 •

edited

Loading