从Angular调用启用Spring Security OAuth的服务器时发生CORS错误

Question

我有一个Angular项目，它将发送一个带有值承载的标头Authoration

在其余部分，服务器运行Spring Boot Spring Security OAuth2ResourceServer。

我有一个安全配置类，它启用了Spring Security，它创建了默认的cors过滤器。

然而，我在运行的浏览器上发现了CORS错误http://localhost:4200.

所以我在SpringApplication类中创建了一个单独的CorsFilter豆。

@Bean
public CorsFilter getCorsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.setAllowedOriginPatterns(Arrays.asList("http://localhost:4200"));
    config.addAllowedHeader("*");
    config.addAllowedMethod("*");
    source.registerCorsConfiguration("/**", config);
    return new CorsFilter(source);
}

我仍然在用户界面上看到CORS错误。

下面是Spring Security配置

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors()        
            .antMatcher("/api/**")
            .authorizeRequests()
            .antMatchers(HttpMethod.GET)
            .hasAnyAuthority("SCOPE_read", "SCOPE_profile", "ROLE_USER")
            .antMatchers(HttpMethod.POST)
            .hasAnyAuthority("SCOPE_read", "SCOPE_profile", "ROLE_USER")
                    .anyRequest().authenticated()
        .and()
          .oauth2ResourceServer()
            .jwt();
    }
}

Answer 1

首先添加“/oauth/Token”如下：

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers(HttpMethod.OPTIONS, "/oauth/token");
} 

然后设置过滤器：

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
@WebFilter("/*")
public class CorsFilter implements Filter {

    public CorsFilter() {
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        final HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "POST, PUT, GET, OPTIONS, DELETE");
        response.setHeader("Access-Control-Allow-Headers", "x-requested-with, authorization");
        response.setHeader("Access-Control-Max-Age", "3600");
        if ("OPTIONS".equalsIgnoreCase(((HttpServletRequest) req).getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else {
            chain.doFilter(req, res);
        }
    }

    @Override
    public void destroy() {
    }

    @Override
    public void init(FilterConfig config) throws ServletException {
    }
}

Answer 2

在分析了一天之后，想出了自定义默认的CorsFilter。

我定义的新鲜过滤豆未被spring security识别。因此，我必须自定义＜code＞http。cors（）如下所示。

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {// @formatter:off
        http.cors(corsCustomiser())        
            .antMatcher("/api/**")
            .authorizeRequests()
            .antMatchers(HttpMethod.GET)
            .hasAnyAuthority("SCOPE_read", "SCOPE_profile", "ROLE_USER")
            .antMatchers(HttpMethod.POST)
            .hasAnyAuthority("SCOPE_read", "SCOPE_profile", "ROLE_USER")
                    .anyRequest().authenticated()
        .and()
          .oauth2ResourceServer()
            .jwt();
    }//@formatter:on

    private Customizer<CorsConfigurer<HttpSecurity>> corsCustomiser() {
        return new Customizer<CorsConfigurer<HttpSecurity>>() {
            @Override
            public void customize(CorsConfigurer<HttpSecurity> t) {
                t.configurationSource(getCorsConfiguration());              
            }           
        };
    }   
    
    private CorsConfigurationSource getCorsConfiguration() {    
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowCredentials(true);
        config.setAllowedOriginPatterns(Arrays.asList("http://localhost:4200"));
        config.addAllowedHeader("*");
        config.addAllowedMethod("*");
        source.registerCorsConfiguration("/**", config);
        return source;
    }
}