在Spring引导中启用Cors,但有角度、静止Cors错误

Question

我为所有源和头启用了cors，但当我从angular应用程序调用get方法到spring Boot时，仍然会出现cors错误。

控制台的Cors错误：

Access to XMLHttpRequest at 'http://localhost:8080/api/users/[e-mail]' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

我的控制器（我调用getbyemail）：

@CrossOrigin(origins = "*", allowedHeaders = "*")
@RestController
@RequestMapping(value = "/api/users", produces = MediaType.APPLICATION_JSON_VALUE)
public class UserController {

    private final UserService userService;

    @Autowired
    public UserController(final UserService userService) {
        this.userService = userService;
    }

    @GetMapping
    public List<UserDTO> getAllUsers() {
        return userService.findAll();
    }

    @GetMapping("/{id}")
    public UserDTO getUser(@PathVariable final Long id) {
        return userService.get(id);
    }

    @CrossOrigin(origins = "*", allowedHeaders = "*")
    @GetMapping("/{email}")
    public UserDTO getUserByMail(@PathVariable String email) {
        return userService.getByEmail(email);
    }

    @PostMapping
    @ResponseStatus(HttpStatus.CREATED)
    public Long createUser(@RequestBody @Valid final UserDTO userDTO) {
        return userService.create(userDTO);
    }

    @PutMapping("/{id}")
    public void updateUser(@PathVariable final Long id, @RequestBody @Valid final UserDTO userDTO) {
        userService.update(id, userDTO);
    }

    @DeleteMapping("/{id}")
    @ResponseStatus(HttpStatus.NO_CONTENT)
    public void deleteUser(@PathVariable final Long id) {
        userService.delete(id);
    }

}

我从我的angular应用程序中调用get：

onSubmit(): void {
    this.submitted = true;
    this.wrongInput = false;
    this.loginService.getLogin<User>(this.loginForm.value.email).subscribe((response) => {
      this.tempUser = response;
      console.log(this.tempUser);
      if (this.loginForm.value.email === this.tempUser.email && this.loginForm.value.password === this.tempUser.password) {
        this.localStorageService.save(this.tempUser);
        this.router.navigate(['/home']);
        console.log(true);
      }
      else {
        this.wrongInput = true;
      }
    });
  }

我还尝试添加devcorsconfiguration:

package com.team13.triviaquiz.triviaquizserver.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
@Profile("development")
public class DevCorsConfiguration implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**").allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS");
    }
}

并在我的application.properties中添加了配置文件：

application.properties
spring.profiles.active=development
#enabling h2 console
spring.h2.console.enabled=true
#fixed URL for H2 (necessary from Spring 2.3.0)
spring.datasource.url=jdbc:h2:mem:triviaquizserver
#turn statistics on
spring.jpa.properties.hibernate.generate_statistics = true
logging.level.org.hibernate.stat=debug
#show all queries
spring.jpa.show-sql=true
spring.jpa.properties.hibernate.format_sql=true
logging.level.org.hibernate.type=trace

但还是没有运气...

Answer 1

这可能是由于Spring库的更改，从而影响了Spring Boot2.4.0。查看此处https://github.com/spring-projects/spring-framework/issues/26111以及其相关票证https://github.com/spring-projects/spring-framework/pull/26108

在此编辑第一个链接的原始消息：

#25016除了只配置AllowedOrigins之外，还引入了配置allowedOriginPatterns的功能。它允许您定义更灵活的模式，而后者实际上是Access-Control-Allow-Origin头中返回的值，因此不允许将“*”与allowCredentials=true结合使用。该更改在WebMvc和WebFlux配置中引入了等价的allowedOriginPatterns方法，但在SockJS配置和AbstractSocketJSService中没有引入。

我会为5.3.2添加这些。然后，您需要切换到AllowedOriginPatters，而不是allowedOrigins，但这为您提供了一个更精确地定义允许的域模式的选项。同时，如果可行的话，您可以通过列出特定的域来解决问题。