Spring security CORS过滤器

Question

这是因为响应中没有附加access-control-allow-origin头。为了解决这个问题，我们添加了自己的筛选器，它位于注销筛选器之前的filter链中，但该筛选器不适用于我们的请求。

我们的错误：

XMLHttpRequest无法加载http://localhost:8080/GetKunden。请求的资源上没有“access-control-allow-origin”标头。因此，不允许访问Originhttp://localhost:3000。响应的HTTP状态代码为401。

@EnableWebSecurity
@Configuration
@ComponentScan("com.company.praktikant")
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

@Autowired
private MyFilter filter;

@Override
public void configure(HttpSecurity http) throws Exception {
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    final CorsConfiguration config = new CorsConfiguration();

    config.addAllowedOrigin("*");
    config.addAllowedHeader("*");
    config.addAllowedMethod("GET");
    config.addAllowedMethod("PUT");
    config.addAllowedMethod("POST");
    source.registerCorsConfiguration("/**", config);
    http.addFilterBefore(new MyFilter(), LogoutFilter.class).authorizeRequests()
            .antMatchers(HttpMethod.OPTIONS, "/*").permitAll();
}

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
}
}

我们的过滤器

@Component
public class MyFilter extends OncePerRequestFilter {

@Override
public void destroy() {

}

private String getAllowedDomainsRegex() {
    return "individual / customized Regex";
}

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {

    final String origin = "http://localhost:3000";

    response.addHeader("Access-Control-Allow-Origin", origin);
    response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS");
    response.setHeader("Access-Control-Allow-Credentials", "true");
    response.setHeader("Access-Control-Allow-Headers",
            "content-type, x-gwt-module-base, x-gwt-permutation, clientid, longpush");

    filterChain.doFilter(request, response);

}
}

我们的申请

@SpringBootApplication
public class Application {
public static void main(String[] args) {
    final ApplicationContext ctx = SpringApplication.run(Application.class, args);
    final AnnotationConfigApplicationContext annotationConfigApplicationContext = new AnnotationConfigApplicationContext();
    annotationConfigApplicationContext.register(CORSConfig.class);
    annotationConfigApplicationContext.refresh();
}
}

我们的筛选器是从Spring-Boot注册的：

尝试了@Piotr Soltysiak的解决方案。cors过滤器没有在生成的过滤器链中列出，我们仍然得到相同的错误。

2016-11-04 10:22:49.881信息8820--[ost-startStop-1]o.ss.web.defaultsecurityfilterchain：创建筛选器链:org.springframework.security.web.util.matcher.anyrequestmatcher@1,[org.springframework.security.web.context.request.async.webasyncmanagerintegrationfilter@4c191377,eRequestFilter@abf2de3,org.SpringFramework.Security.Web.Authentication.AnonymousAuthenticationFilter@2a5c161b,org.SpringFramework.Security.Web.Session.SessionManagementFilter@3c1fd3e5,org.SpringFramework.Security.Web.Access.ExceptionTranslationFilter@3d7055ef,org.SpringFramework.Security.Web.Access.Intercept.FilterSecurityInterceptor

顺便说一句，我们使用的是spring-security版本4.1.3！

Answer 1

由于Spring Security 4.1，这是使Spring Security支持CORS的正确方法（在Spring Boot 1.4/1.5中也需要）：

@Configuration
public class WebConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedMethods("HEAD", "GET", "PUT", "POST", "DELETE", "PATCH");
    }
}

和：

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
//        http.csrf().disable();
        http.cors();
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        final CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(ImmutableList.of("*"));
        configuration.setAllowedMethods(ImmutableList.of("HEAD",
                "GET", "POST", "PUT", "DELETE", "PATCH"));
        // setAllowCredentials(true) is important, otherwise:
        // The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
        configuration.setAllowCredentials(true);
        // setAllowedHeaders is important! Without it, OPTIONS preflight request
        // will fail with 403 Invalid CORS request
        configuration.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type"));
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

请勿执行以下任何操作，这些操作都是试图解决问题的错误方法：

• HTTP.AuthorizeRequests().AntMatchers(HTTPMethod.Options，“/**”）.PermitAll（）；
• web.忽略（）.antMatchers（HttpMethod.Options）；