HTTP CORS headers not included.

Describe the bug

We have the following settings in our application properties

quarkus.http.cors=${QUARKUS_HTTP_CORS_ENABLED:true}
quarkus.http.cors.methods=${QUARKUS_HTTP_CORS_METHODS:GET,POST}
quarkus.http.cors.access-control-max-age=${QUARKUS_HTTP_CORS_ACCESS_CONTROL_MAX_AGE:24H}

Expected behavior

CORS headers included

Actual behavior

CORS headers not included.

However, changing the configuration (strangly enough) to

quarkus.http.cors=false

Or omitting this setting altogether will trigger the headers.

which seems to be in conflict to the documentation

How to Reproduce?

Service with quarkus.http.cors=false: https://publiek.broservices.nl/gm/gmw-v1.1/openapi

Service with

quarkus.http.cors=${QUARKUS_HTTP_CORS_ENABLED:true}
quarkus.http.cors.methods=${QUARKUS_HTTP_CORS_METHODS:GET,POST}
quarkus.http.cors.access-control-max-age=${QUARKUS_HTTP_CORS_ACCESS_CONTROL_MAX_AGE:24H}

https://publiek.broservices.nl/gm/gmn-v1.0/openapi

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

2.3.1.Final

Build tool (ie. output of mvnw --version or gradlew --version)

mvn 3.6.3

Additional information

No response

[sjaakd]

Hi @sjaakd @sberyozkin - Happy to have a look. Please provide a small reproducer that I can run locally. Thanks 😃

Hi @phillip-kruger thanks… I’ll do my best to provide one as soon as possible (hopefully a bit later this week).

[sjaakd]

@sjaakd Thanks, what happens if you do:

quarkus.http.cors=true
quarkus.http.cors.methods=GET,POST
quarkus.http.cors.access-control-max-age:24H

? Would like to see if the system property replacement is a problem or not

Just tried that locally.

No effect.