Support CORS configuration [181537068]

Assigned

Feature Request

Status Update

No update yet.

Description

os...@einride.tech

created issue #1

Mar 1, 2021 04:31PM

As discussed in the Cloud Endpoints User Group, it's currently not possible to configure CORS for the fully managed API Gateway.

https://groups.google.com/g/google-cloud-endpoints/c/bEdvXEXYbYI

The suggested workaround to handle OPTIONS headers in the downstream service(s) is not possible when using API Gateway with gRPC backends.

In practice, this makes API Gateway an impractical choice for gRPC users. At my current company, we would like to migrate from Cloud Endpoints to API Gateway, but are holding off migration until support for basic CORS configuration makes it feasible.

I'm creating this public issue so that we and other gRPC users can track progress toward CORS support.

Cheers!

Comments

[Deleted User] <[Deleted User]> #2Mar 1, 2021 05:21PM

Hi Josh, friendly ping for an update on progress

Message last modified on Mar 1, 2021 05:22PM

al...@einride.tech <al...@einride.tech> #3Mar 17, 2021 06:30PM

i think the TL;DR is that this is stuck behind investigating the current lab outages, which are more urgent.

pending CL is https://android-review.googlesource.com/c/platform/system/core/+/1250677.

os...@einride.tech <os...@einride.tech> #4Mar 31, 2021 02:28PM

Have you consider snappy or zstd? From my experience snappy compresses at around 200~300MB/s with reasonable compression rate ~30%.

di...@google.com <di...@google.com> #5May 13, 2021 08:51PM

Assigned to gc...@google.com.

For brotli, try quality level 1, this can give around 150-200MB/s with a much better compression ration than snappy of over 60%. Brotli quality 0 is even faster for still over 50% compression.

os...@einride.tech <os...@einride.tech> #6May 14, 2021 06:51AM

Hmm, gerrit-watcher didn't post the CLs on this bug, so I guess I'll do so manually:

https://android.googlesource.com/platform/system/core/+/939fc19aee7f6a19ce0f4fa91557bbbe9cd974f5 added brotli support (with quality level 1)

https://android.googlesource.com/platform/system/core/+/ec44d35fde60d20d9ab1c6fb9ac7ee844335f1eb added LZ4

Throughput numbers from a device:

           none    brotli    lz4
USB 3.0     120       110    190
USB 2.0      38        75     63

I'm seeing identical throughput with brotli quality 0 and 1 (110MB/s end to end), although there's some giant low hanging fruit to compress multiple files at once.

zstd isn't in the tree yet (I started the ball rolling on that, but no idea when it'll end up getting merged), but I'll take a look at it eventually, probably when I get around to implementing compression for generic streams in adb (b/153901735).

This is probably good enough to call this fixed for now.

[Deleted User] <[Deleted User]> #7Aug 4, 2021 01:11PM

This would be really useful for us, we're using cloud run for all our microservices and want to call these from a SPA via API Gateway. Can do the options double request workaround but ideal if we could set cors up on the gateway itself. Many thanks!

[Deleted User] <[Deleted User]> #8Nov 11, 2021 09:23PM

Any updates here? This would be a very important feature for our team.

al...@einride.tech <al...@einride.tech> #9Nov 12, 2021 09:45AM

See this thread for more info on the matter

https://groups.google.com/g/api-gateway-users/c/9CwyQr1c420/m/_U1FbBvNBAAJ

lo...@gmail.com <lo...@gmail.com> #10Sep 6, 2022 11:36PM

Bumping this;

Per the discussion linked above, it was said:

Hello Zion, We have a change to our plans for delivering this feature in API Gateway. At the moment we do not have plans to add support for CORS in API Gateway. I apologize for any inconvenience this caused to your plans for adoption of the service.

That makes API Gateway a poor option for webapps when compared to ESPv2 - if you have to manually manage OPTION calls, what is the point of a 'fully managed service'? CORS support & configuration is a critical component to any webapp, and until that necessary feature is added, API Gateway is both incomplete and a not a service I feel comfortable recommending. I highly encourage the priority of this feature to be increased, as I think the rest of it is great - but this feature missing makes it the wrong choice over ESPv2

Message last modified on Sep 6, 2022 11:45PM

pr...@exponent.ai <pr...@exponent.ai> #11Sep 7, 2022 08:48AM

It should be noted that you can add unauthenticated OPTIONS handlers to each endpoint to solve this.

Pretty trivial to automate, why it is not included in the startup docs is beyond me.

- Show quoted text -

ry...@gmail.com <ry...@gmail.com> #12Oct 18, 2022 03:42AM

Any updates here? I saw estimates in a thread that this would be done in Q2 of last year.

al...@parsd.com <al...@parsd.com> #13Nov 2, 2022 04:37PM

Me too; we ran into the same problem using Firebase authentication to a backend function exposed using API Gateway. Any news of there roadmap and estimates when this can be included in the API Gateway product?

va...@google.com <va...@google.com> May 4, 2023 06:20AM

Reassigned to ku...@google.com.

to...@edisoninteractive.com <to...@edisoninteractive.com> #14Jun 5, 2023 06:07PM

HI all, are there updates here? I saw estimates in a thread that this would be done in Q2 of 2021.

ku...@google.com <ku...@google.com> Jun 7, 2023 12:31PM

Reassigned to gc...@google.com.

ma...@1qlabs.ai <ma...@1qlabs.ai> #15Oct 31, 2023 08:48PM

Still interested in any updates on this...

gy...@denimhealth.com <gy...@denimhealth.com> #16Dec 1, 2023 10:23PM

Any development?