来自邮递员的邮件请求的跨来源问题

Question

我正在编写一个具有交叉源配置的API

我的websecurity配置有

@Bean
    public FilterRegistrationBean corsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowCredentials(Boolean.TRUE);
        config.addAllowedOrigin("*");
        config.addAllowedHeader("*");
        config.addAllowedMethod("*");
        source.registerCorsConfiguration("/**", config);
        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
        bean.setOrder(0);
        return bean;
    }

    @Bean
    public FilterRegistrationBean someFilterRegistration() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(someFilter());
        registration.addUrlPatterns("/abc/*");
        registration.setOrder(1);
        return registration;
    }

控制器类

@CrossOrigin(origins = "*", maxAge = 3600)
@RestController
@RequestMapping("/gdpr/1.0")
public class AbcController {
 

    @PostMapping("/request")
    ReturnStatus saveRequest(HttpServletRequest request,
                             @RequestParam(value = "requestType", required = true) RequestType requestType,
                             @RequestParam(value = "Type", required = true) Type Type,
                             @RequestParam(value = "file", required = true)
                                     MultipartFile uploadedFile) throws InvalidInputException {
        
    }

身份验证过滤器检查

private static final Pattern HEALTH_CHECK = Pattern.compile("^.+/abc/[\\d]+\\.[\\d]+/?$");
        @Override
            protected void doFilterInternal(HttpServletRequest request,
                                            HttpServletResponse response, FilterChain filterChain)
                    throws ServletException, IOException {
        
                StringBuffer requestURL = request.getRequestURL();
        
                if (isHealthCheck(requestURL)) {
                    filterChain.doFilter(request, response);
                    return;
                }
        
                String source = UNKNOWN;
    
    boolean isHealthCheck(StringBuffer requestURL) {
            if (requestURL != null) {
                Matcher matcher = HEALTH_CHECK.matcher(requestURL.toString());
                return matcher.matches();
            }
            return false;
        }

匹配。匹配总是变假

我是不是漏掉了什么？

我添加了什么额外的参数吗？

期待着迅速的回应。

Answer 1

403响应与CORS无关。（此外，Postman不受CORS设置的影响。）

可能是CSRF保护自动配置造成的。

您可以尝试禁用它：

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
    }
}