用于弹簧靴的 CORS 过滤器不起作用

Posted 2023-02-27

【中文标题】用于弹簧靴的 CORS 过滤器不起作用

【英文标题】：CORS filter for spring boot not working

【发布时间】：2016-10-21 10:14:52

【问题描述】：

我在@Configuration 下添加了以下内容

@Bean
public FilterRegistrationBean corsFilter() 
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.addAllowedOrigin("*");
    config.addAllowedHeader("*");
    config.addAllowedMethod("OPTIONS");
    config.addAllowedMethod("HEAD");
    config.addAllowedMethod("GET");
    config.addAllowedMethod("PUT");
    config.addAllowedMethod("POST");
    config.addAllowedMethod("DELETE");
    config.addAllowedMethod("PATCH");
    source.registerCorsConfiguration("/**", config);
    // return new CorsFilter(source);
    final FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
    bean.setOrder(0);
    return bean;

还有：

@Bean
    public WebMvcConfigurer mvcConfigurer() 
        return new WebMvcConfigurerAdapter() 
            @Override
            public void addCorsMappings(CorsRegistry registry) 
                registry.addMapping("/**").allowedMethods("GET", "PUT", "POST", "GET", "OPTIONS");
            
        ;
    

这两个我都不启用，

但是当我使用 CURL 触发 CORS 预检请求时，我得到以下信息：

 HTTP/1.1 200 OK
< Server: Apache-Coyote/1.1
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< X-Frame-Options: DENY
< Access-Control-Allow-Origin: www.example.com
< Vary: Origin
< Access-Control-Allow-Credentials: true
< Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
< Content-Length: 0
< Date: Mon, 20 Jun 2016 08:26:06 GMT
<
* Connection #6 to host localhost left intact

使用：

curl -H "Origin: www.example.com" \ -H "x-auth-token: 93f8ddb4-d2db-4c8f-b30e-a9fb8468437b" -H "Access-Control-Request-Method: POST" \ - H "Access-Control-Request-Headers: X-Requested-With" \ -X OPTIONS --verbose \ http://localhost:8181

我觉得理想的输出必须是这样的：

http://learntogoogleit.com/post/61327173902/cors-preflight-request-testing-in-curl

我明白了 不支持使用 Angular 客户端的 CORS 预检模型

【参考方案1】：

您可以尝试在控制器类的顶部使用@CrossOrigin 注释吗？