Jaeger UI CORS vs Direct Collector Access for Cross-Domain Secure Queries
0 reputation · 20 Sept 2020, 23:55 UTC
Cross-Domain Query Access with TLS in Jaeger
Jaeger UI makes API calls to /api/traces using same-origin policy by default. When the UI is served from a different DNS name than the collector endpoint, the browser enforces CORS restrictions that can block query requests.
Two documented approaches exist for resolving this constraint with TLS-secured collector access. Option 1 configures CORS headers on the Query service to allow cross-origin requests from the UI domain. Option 2 uses the --collector.host-port flag to establish direct collector access from the Query service, bypassing DNS resolution and CORS requirements entirely.
The constraint requires maintaining secure TLS connections while ensuring the UI can retrieve trace data. CORS configuration introduces additional header management complexity, whereas direct collector access shifts the resolution dependency to internal service networking.
Which approach better balances security requirements and operational simplicity when Jaeger UI and collector operate under different DNS namespaces with TLS enabled?
- How does CORS header configuration interact with Jaeger's built-in TLS termination?
- What are the networking implications of using
--collector.host-portversus standard DNS-based collector discovery?
jaegertracing