如何访问后端，如果阻止cors策略javaSpring？[关闭]

Question

我使用JavaSpring作为后端，当前端命中我的endpoint时，他得到了错误

访问位于“”的XMLHttpRequesthttp://192.168.100.74:9009/v1/admin/c2da6237-22d2-433a-97b7-226d1989bd99/列出用户“来源”http://localhost:3001'已被CORS策略阻止：对飞行前请求的响应未通过访问控制检查：它没有HTTP ok状态。

我使用JavaSpring，如何处理这个问题？谢谢

Answer 1

您需要允许要从其中授予访问权限的客户端域调用API。为此，您可以简单地创建CORSFilter。下面是最小的CORSFilter实现：

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class CorsFilter implements Filter {

/*
 * (non-Javadoc)
 * 
 * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
 */
@Override
public void init(FilterConfig filterConfig) throws ServletException {

}

/*
 * (non-Javadoc)
 * 
 * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest,
 * javax.servlet.ServletResponse, javax.servlet.FilterChain)
 */
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
        throws IOException, ServletException {
    HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;
    HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse;
    httpServletResponse.addHeader("Access-Control-Allow-Origin", "*"); // IMPORTANT: Allowed all the domains
    httpServletResponse.addHeader("Access-Control-Allow-Methods", "OPTIONS, GET, POST, DELETE, PUT, PATCH, HEAD");
    httpServletResponse.addHeader("Access-Control-Allow-Headers",
            "Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Allow-Origin, Authorization");
    httpServletResponse.addHeader("Access-Control-Expose-Headers",
            "Access-Control-Allow-Origin, Access-Control-Allow-Credentials, Content-Disposition");
    httpServletResponse.addHeader("Access-Control-Allow-Credentials", "true");
    httpServletResponse.addIntHeader("Access-Control-Max-Age", 3600);
    if ("OPTIONS".equalsIgnoreCase(httpServletRequest.getMethod())) {
        httpServletResponse.setStatus(HttpServletResponse.SC_OK);
    } else {
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }
}

/*
 * (non-Javadoc)
 * 
 * @see javax.servlet.Filter#destroy()
 */
@Override
public void destroy() {

}
}

具体关注上面代码中的Access-Control-允许-起源头。

Answer 2

您需要向控制器方法添加一个@CrossOrigin注释。请参阅https://spring.io/guides/gs/rest-service-cors/"启用CORS"标题下的详细说明。