通过Spring Security启用CORS Spring问题

Question

我需要为使用Spring Security性的Spring应用程序启用CORS，但它不工作。我正在向发出获取请求http://localhost:3000（即node.js服务器）到http://localhost:8080（这是Tomcat服务器）。

我尝试了以下方法，但无法使它们中的任何一个起作用：https://spring.io/blog/2015/06/08/cors-support-in-spring-framework

Spring Data Rest和Cors

https://gist.github.com/zeroows/80bbe076d15cb8a4f0ad

使用 Spring Boot 1.3.3-RELEASE 启用 CORS

Spring CORS 控制器注释不起作用

目前我有一个@控制器：

@Controller
@RequestMapping("/views")
public class LoginController{

@Autowired
private EventService eventService;

@RequestMapping(value = "/companies", method = RequestMethod.GET, produces = "application/json")
@ResponseBody
    public String listCompanies(Model model) {
        String companiesList = eventService.getCompanies();
        return companiesList;
    }
}

以及＜code＞AppConfig＜/code＞文件，其中我尝试允许＜code＞CORS＜/code＞失败：

@EnableWebMvc 
@Configuration
public class AppConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**");
    }
}

我想从我的< code>Angular2应用程序中的< code>listCompanies方法获取< code>json。我收到< code > No ' Access-Control-Allow-Origin ' header is present 错误，所以我认为这是< code>CORS问题。

Answer 1

   import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.web.filter.OncePerRequestFilter;

/**
 * Enabling CORS support  - Access-Control-Allow-Origin
 * 
 * 
 * <code>
    <!-- Add this to your web.xml to enable "CORS" -->
    <filter>
      <filter-name>cors</filter-name>
      <filter-class>com.elm.mb.rest.filters.CORSFilter</filter-class>
    </filter>

    <filter-mapping>
      <filter-name>cors</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>
 * </code>
 */
public class CORSFilter extends OncePerRequestFilter {
    private static final Log LOG = LogFactory.getLog(CORSFilter.class);

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        response.addHeader("Access-Control-Allow-Origin", "*");

        if (request.getHeader("Access-Control-Request-Method") != null && "OPTIONS".equals(request.getMethod())) {
            LOG.trace("Sending Header....");
            // CORS "pre-flight" request
            response.addHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
//          response.addHeader("Access-Control-Allow-Headers", "Authorization");
            response.addHeader("Access-Control-Allow-Headers", "Content-Type");
            response.addHeader("Access-Control-Max-Age", "1");
        }

        filterChain.doFilter(request, response);
    }

}

Answer 2

您是否在Spring配置中定义了允许的原点？http://localhost:8080

@EnableWebMvc 
@Configuration
public class AppConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
        .allowedOrigins("http://localhost:3000")
        .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
        .allowCredentials(true);
    }
}

查看官方文档第27.3章，以启用全局CORS配置：http://docs.spring.io/spring/docs/current/spring-framework-reference/html/cors.html

如果您不需要在跨源请求中包含cookie，请将. lowCrephaals（true）替换为. lowCrephaals（false）

Answer 3

我遇到了类似的问题，并使用自定义过滤器修复了它，如文档中所述：27.5基于过滤器的CORS支持

基本上，您需要创建过滤器：

public class MyCorsFilter extends CorsFilter {

    public MyCorsFilter() {
        super(configurationSource());
    }

    private static UrlBasedCorsConfigurationSource configurationSource() {
        CorsConfiguration config = new CorsConfiguration();
        config.addAllowedOrigin("*");
        config.addAllowedMethod("*");
        config.addAllowedHeader("*");
        config.setAllowCredentials(true);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", config);
        return source;
    }

}

然后在springSecurityFilterChain之前将其添加到web.xml（或相应的基于java的配置）中，如下所示：

<filter>
    <filter-name>corsFilter</filter-name>
    <filter-class>com.example.configuration.cors.MyCorsFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>corsFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

我还有dispatchOptionsRequest（根据新文档，这不是必需的）：

<servlet>
    <servlet-name>appServlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    ...
    <!-- "OPTIONS" method support -->
    <init-param>
        <param-name>dispatchOptionsRequest</param-name>
        <param-value>true</param-value>
    </init-param>
    ...
</servlet>