启用 CORS 和解决 403 Forbidden 错误的问题

Posted 2023-03-04

【中文标题】启用 CORS 和解决 403 Forbidden 错误的问题

【英文标题】：Issue with enabing CORS and solving 403 Forbidden error

【发布时间】：2018-01-05 07:12:13

【问题描述】：

我尝试解决在向我的 GeoServer 发送请求时遇到的错误 403 Forbidden。为了调试这个过程，我使用 Chrome 中 Inspect 选项中的 Network 选项卡（我也尝试过 Firefox）。这是我在“网络”选项卡中看到的错误。

XMLHttpRequest 无法加载 http://localhost:8080/geoserver/square/ows?service=WFS&version=1.1.0&requ…ture&typeName=square:InformationStores&outputFormat=application%2Fjson。 对预检请求的响应未通过访问控制检查：否 请求中存在“Access-Control-Allow-Origin”标头 资源。因此不允许使用原点“http://localhost:5601” 使用权。响应的 HTTP 状态代码为 403。

根据我在该主题上找到的多个教程，我的 GeoServer 2.10.4 启用了 CORS。但是，我收到的错误消息似乎与代理有关。

我花了很多时间试图解决这个问题，所以最后，我完全迷失了。我尝试了很多东西，但没有任何效果。

这是我向其发送请求的 GeoServer 的配置文件：

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd"> <web-app>
    <display-name>GeoServer</display-name>

      <context-param>
    <param-name>serviceStrategy</param-name>
    <!-- Meaning of the different values :

         PARTIAL-BUFFER2
         - Partially buffers the first xKb to disk. Once that has buffered, the the 
           result is streamed to the user. This will allow for most errors to be caught
           early. 

         BUFFER
         - stores the entire response in memory first, before sending it off to
           the user (may run out of memory)

         SPEED
         - outputs directly to the response (and cannot recover in the case of an
           error)

         FILE
         - outputs to the local filesystem first, before sending it off to the user
      -->
    <param-value>PARTIAL-BUFFER2</param-value>   </context-param>
     <context-param>
    <!-- see comments on the PARTIAL-BUFFER strategy -->
    <!-- this sets the size of the buffer.  default is "50" = 50kb -->

    <param-name>PARTIAL_BUFFER_STRATEGY_SIZE</param-name>
    <param-value>50</param-value>   </context-param>
     <!--Can be true or false (defaults to: false). -->   <!--When true the JSONP (text/javascript) output format is enabled -->   <!--   <context-param>
    <param-name>ENABLE_JSONP</param-name>
    <param-value>true</param-value>   </context-param>   -->
    <!-- 
    <context-param>
      <param-name>PROXY_BASE_URL</param-name>
      <param-value>http://localhost/geoserver</param-value>
    </context-param>
     -->

     <!--
    <context-param>
       <param-name>GEOSERVER_DATA_DIR</param-name>
        <param-value>C:\eclipse\workspace\geoserver_trunk\cite\confCiteWFSPostGIS</param-value>
    </context-param>     -->

    <!-- pick up all spring application contexts -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath*:/applicationContext.xml classpath*:/applicationSecurityContext.xml</param-value>
    </context-param>

    <filter>
     <filter-name>FlushSafeFilter</filter-name>
     <filter-class>org.geoserver.filters.FlushSafeFilter</filter-class>
    </filter>

    <filter>
      <filter-name>Set Character Encoding</filter-name>
      <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
      <init-param>
        <param-name>encoding</param-name>
        <param-value>UTF-8</param-value>
      </init-param>
    </filter>

    <filter>
     <filter-name>SessionDebugger</filter-name>
     <filter-class>org.geoserver.filters.SessionDebugFilter</filter-class>
    </filter>

    <filter>
    <filter-name>filterChainProxy</filter-name>     
     <filter-class> org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter>
      <filter-name>xFrameOptionsFilter</filter-name>
      <filter-class>org.geoserver.filters.XFrameOptionsFilter</filter-class>
    </filter>

   <filter>
     <filter-name>GZIP Compression Filter</filter-name>
     <filter-class>org.geoserver.filters.GZIPFilter</filter-class>
     <init-param>
         <!-- The compressed-types parameter is a comma-separated list of regular expressions.
              If a mime type matches any of the regular expressions then it will be compressed.
              -->
         <param-name>compressed-types</param-name>
         <param-value>text/.*,.*xml.*,application/json,application/x-javascript</param-value>
     </init-param>    </filter>

   <filter>
     <filter-name>Request Logging Filter</filter-name>
     <filter-class>org.geoserver.filters.LoggingFilter</filter-class>
     <init-param>
         <!-- The 'enabled' parameter is a boolean value, "true" (case-insensitive) for true or
              any other value for false.  If enabled, then the logging will be performed;
              otherwise the logging filter will have no effect.  If not specified, this 
              parameter defaults to false.
              -->
         <param-name>enabled</param-name>
         <param-value>false</param-value>
     </init-param>
     <init-param>
     <!-- The 'log-request-bodies' parameter is a boolean value, "true" (case-insensitive) for
          true or any other value for false.  If enabled, then the logging will include the body
          of POST and PUT requests.  If not specified, this parameter defaults to false.
          Note that this may noticeably degrade responsiveness of your geoserver since it will
          not begin to process requests until the entire request body has been received by the 
          server.
          -->
     <param-name>log-request-bodies</param-name>
     <param-value>false</param-value>
     </init-param>    </filter>
       <filter>
     <filter-name>Advanced Dispatch Filter</filter-name>
     <filter-class>org.geoserver.platform.AdvancedDispatchFilter</filter-class>
     <!-- 
     This filter allows for a single mapping to the spring dispatcher. However using /* as a mapping
     in a servlet mapping causes the servlet path to be "/" of the request. This causes problems with
     library like wicket and restlet. So this filter fakes the servlet path by assuming the first 
     component of the path is the mapped path. 
     -->    </filter>
       <filter>
    <filter-name>Spring Delegating Filter</filter-name>
    <filter-class>org.geoserver.filters.SpringDelegatingFilter</filter-class>
    <!--
    This filter allows for filters to be loaded via spring rather than 
    registered here in web.xml.  One thing to note is that for such filters 
    init() is not called. INstead any initialization is performed via spring 
    ioc.
    -->    </filter>
       <filter>
     <filter-name>Thread locals cleanup filter</filter-name>
     <filter-class>org.geoserver.filters.ThreadLocalsCleanupFilter</filter-class>
     <!-- 
     This filter cleans up thread locals Geotools is setting up for concurrency and performance
     reasons 
     -->    </filter>    <!-- Uncomment following filter to enable CORS -->    <filter>
        <filter-name>cross-origin</filter-name>
        <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class>
    </filter>

    <!-- 
      THIS FILTER MUST BE THE FIRST ONE, otherwise we end up with ruined chars in the input from the GUI
      See the "Note" in the Tomcat character encoding guide:
      http://wiki.apache.org/tomcat/FAQ/CharacterEncoding
    -->
    <filter-mapping>
      <filter-name>Set Character Encoding</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>
       <!-- Uncomment following filter to enable CORS -->
    <filter-mapping>
        <filter-name>cross-origin</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter-mapping>
      <filter-name>FlushSafeFilter</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter-mapping>
      <filter-name>SessionDebugger</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter-mapping>
      <filter-name>GZIP Compression Filter</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter-mapping>
      <filter-name>xFrameOptionsFilter</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter-mapping>
      <filter-name>Request Logging Filter</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- 
      If you want to use your security system comment out this one too
    -->
    <filter-mapping>
      <filter-name>filterChainProxy</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter-mapping>
      <filter-name>Advanced Dispatch Filter</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter-mapping>
      <filter-name>Spring Delegating Filter</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter-mapping>
      <filter-name>Thread locals cleanup filter</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- general initializer, should be first thing to execute -->
    <listener>
      <listener-class>org.geoserver.GeoserverInitStartupListener</listener-class>
    </listener>

    <!-- logging initializer, should execute before spring context startup -->
    <listener>
      <listener-class>org.geoserver.logging.LoggingStartupContextListener</listener-class>
    </listener>

    <!--  spring context loader -->
    <listener>
      <listener-class>org.geoserver.platform.GeoServerContextLoaderListener</listener-class>
    </listener>

    <!--  http session listener proxy -->
    <listener>
      <listener-class>org.geoserver.platform.GeoServerHttpSessionListenerProxy</listener-class>
    </listener>

    <!-- request context listener for session-scoped beans -->  <listener>      <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>     </listener>

    <!-- spring dispatcher servlet, dispatches all incoming requests -->
    <servlet>
      <servlet-name>dispatcher</servlet-name>
      <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    </servlet>

    <!-- single mapping to spring, this only works properly if the advanced dispatch filter is 
         active -->
    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>/*</url-pattern>
    </servlet-mapping>

    <mime-mapping>
      <extension>xsl</extension>
      <mime-type>text/xml</mime-type>
    </mime-mapping>
    <mime-mapping>
      <extension>sld</extension>
      <mime-type>text/xml</mime-type>
    </mime-mapping>
    <mime-mapping>
      <extension>json</extension>
      <mime-type>application/json</mime-type>
    </mime-mapping>

    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
    </welcome-file-list>
     </web-app>

【问题讨论】：

请检查一下，我相信你也有同样的问题gis.stackexchange.com/questions/210316/…

@2oppin：谢谢，但这正是我所做的（很多次！）。因此，我将<filter> <filter-name>cross-origin</filter-name> <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class> </filter> <filter-mapping> <filter-name>cross-origin</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> 添加到GeoServer 的web.xml 中，并将适当版本的jetty jar 放入WEB-INF/lib。

我不知道 geoServer，但我想它可能是在其他一些 http 服务器上设置的。你用码头吗？我想根据服务器 apache/tomcat/jetty 他们都使用自己的过滤器，如果你有一些用 spring 构建的自定义服务器，那么你应该手动添加标题

@2oppin：是的，我使用 Jetty。基本上我有 GeoServer（服务器端）和 Kibana（客户端）。而已。 GeoServer 位于端口 8080，而 Kibana 运行在端口 5601。两者都在同一个域上（嗯，现在它只是 localhost）。我没有任何自定义服务器。特别是Remote Address:127.0.0.1:8080 Host:localhost:8080 Origin:http://localhost:5601 Referer:http://localhost:5601/app/kibana

尝试使用最新的 Jetty 版本，eclipse.org/jetty/documentation/9.4.x/cross-origin-filter.html 尝试在初始化参数中添加标头，就像这个问题 ***.com/questions/8303162/jetty-cross-origin-filter

【参考方案1】：

请查看我对此question 的回答。

无需添加到 web.xml，只需取消注释已存在的 两个 CORS 相关块。

【讨论】：

我用不同版本的 Geoserver 做到了:) 它不工作。对我来说，它只适用于带有 Catalina 而不是 Jetty 的 Apache Tomcat。

我昨天用 2.10.3 做的，效果很好

你用 Kibana 测试过吗？

这与 Kibana 有什么关系？它不处理 CORS 请求吗？