Spring boot中的Cors策略问题：自定义头问题

Question

我们正在开发一个Spring Boot程序和angularjs应用程序。我们使用JWT令牌和LDAP身份验证。LDAP身份验证后，service生成jwt令牌并发送给angular，从下一次开始，angular将令牌和用户名发送回service，angular将令牌存储在会话存储中。

setHeaders: {
    "customHeader1":"userName",
    "customHeader2":"jwtToken"
 }

@Configuration
 public class CustomSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests().antMatchers("/*").permitAll();
        http.cors();
    }

   @Bean
   public CorsConfigurationSource corsConfigurationSource() {
    final CorsConfiguration configuration = new CorsConfiguration();
    List<String> originList = new ArrayList<String>();
    List<String> methodList = new ArrayList<String>();
    List<String> headerList = new ArrayList<String>();
    originList.add("*"); 
    methodList.add("HEAD");methodList.add("GET");methodList.add("POST");methodList.add("PUT");
    methodList.add("DELETE");methodList.add("PATCH");
    headerList.add("Authorization");
    headerList.add("Cache-Control");
    headerList.add("Content-Type");
    headerList.add("customHeader1");
    headerList.add("customHeader2");
    configuration.setAllowedOrigins(Collections.unmodifiableList(originList)); 
    configuration.setAllowedMethods(Collections.unmodifiableList(methodList));
    // setAllowCredentials(true) is important, otherwise:
    // The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
    configuration.setAllowCredentials(true);
    // setAllowedHeaders is important! Without it, OPTIONS preflight request
    // will fail with 403 Invalid CORS request
    configuration.setAllowedHeaders(Collections.unmodifiableList(headerList));
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}
   }

@Component
public class CustomAuthInterceptor extends HandlerInterceptorAdapter {

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
        throws Exception {
    String header1 = null;
    String header2 = null;

        if (StringUtils.isNotBlank(request.getHeader("customHeader1"))) {
            header1 = request.getHeader("customHeader1");
        }
        if (StringUtils.isNotBlank(request.getHeader("customHeader2"))) {
            header2 = request.getHeader("customHeader2");
        }
        System.out.println("customtoken="+header1+"|customUserName="+header2); 

            //LDAP service call


                if (StringUtils.equalsIgnoreCase(response, "success")) {
                    return true;
                } else {
                    response.setStatus(<CUSTOM_ERROR_CODE>); //custom error code
                    return false;
                }
          } 
      }
   }

@Configuration
public class CustomWebConfig implements WebMvcConfigurer
{
   @Autowired
   private CustomAuthInterceptor customAuthInterceptor ;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
       registry.addInterceptor(customAuthInterceptor);
    }

   @Override
   public void addCorsMappings(CorsRegistry registry) {
       registry.addMapping("/**")
       .allowedMethods("HEAD", "GET", "PUT", "POST", "DELETE", "PATCH");
    }
  }

有人能解决这个问题吗？？？？

Answer 1

飞行前请求被阻止，因为您没有启用选项请求类型。

将此语句添加到Cors Bean配置中。

methodList.add("OPTIONS");