CORS 问题：“访问控制-允许-源'标头不存在

Question

我正在开发一个带有jhipster V4.5.6的Spring启动应用程序。但无法配置 CORS。

下面是我的application-dev.yml文件:

 # CORS is only enabled by default with the "dev" profile, so BrowserSync can access the API
cors:
    allowed-origins: "http://localhost:9000"
    allowed-methods: GET, PUT, POST, DELETE, OPTIONS
    allowed-headers: "*"
    exposed-headers:
    allow-credentials: true
    max-age: 1800

WebConfigurer.java如下：

@Bean
public CorsFilter corsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = jHipsterProperties.getCors();
    if (config.getAllowedOrigins() != null && !config.getAllowedOrigins().isEmpty()) {
        log.debug("Registering CORS filter");
        source.registerCorsConfiguration("/api/**", config);
        source.registerCorsConfiguration("/v2/api-docs", config);
    }
    return new CorsFilter(source);
}

和安全配置。java文件如下所示：

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring()
        .antMatchers(HttpMethod.OPTIONS, "/**")
        .antMatchers("/test/**");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf()
        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
    .and()
        .addFilterBefore(corsFilter, UsernamePasswordAuthenticationFilter.class)
        .exceptionHandling()
        .authenticationEntryPoint(http401UnauthorizedEntryPoint())
    .and()
        .authorizeRequests()
        ... //Some project specific configuration
}

现在，我可以使用 GET 请求。但是当我使用POST时，如下所示：

private demoCors(restUrl: string, input: any): Observable<Result> {
    let headers = new Headers({ 'Content-Type': 'application/json' });
    let options = new RequestOptions({ headers: headers });
    return this.http.post(restUrl, JSON.stringify(input), options)
    .map(this.extractData)
    .catch(this.handleError);
}

我得到以下错误：

POST http://localhost:8080/api/dth 403 (Forbidden)

XMLHttpRequest 无法加载 http://localhost:8080/api/dth。请求的资源上不存在“访问控制-允许-源”标头。因此，不允许访问源“http://localhost:9000”。响应具有 HTTP 状态代码 403。

任何人都可以建议如何解决它？

Answer 1

你能试试这个吗。

# CORS is only enabled by default with the "dev" profile, so BrowserSync can access the API
cors:
    allowed-origins: "*"
    allowed-methods: GET, PUT, POST, DELETE, OPTIONS
    allowed-headers: "*"
    exposed-headers:
    allow-credentials: true
    max-age: 1800