Spring security+session:接收“set-cookie”头，但未在浏览器中设置

Question

我正在尝试Spring Security&Session和一个棱角分明的前端。当尝试使用响应头登录时，我得到一个200代码：

Set-Cookie: SESSION=NGJlYTkzODQtNTQzMy00NGIxLWEzOWYtYTc2MGNlZWY1OTJm; Path=/; HttpOnly; SameSite=Lax

但在我对服务器的下一个请求中，请求中没有自动设置cookie。顺便说一下，我在开发工具中看不到cookie，所以我认为它没有保存。

我在本地工作的前端和后端。

以下是有关后端的一些信息：

>

使用Spring MongoDb会话@Configuration@EnableMongoHttpSession公共类SessionConfig{}

• 经典Spring Security配置

`@EnableWebSecurity公共类SecurityConfig扩展WebSecurityConfigurerAdapter{private final CustomAuthenticationProvider AuthProvider；

public SecurityConfig(CustomAuthenticationProvider authProvider) {
    this.authProvider = authProvider;
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authProvider);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .cors().and()
        .authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .httpBasic(); //todo csrf
}

@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Collections.singletonList("http://localhost:4200")); // todo properties by environment
    configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "DELETE", "PUT", "PATCH"));
    configuration.setAllowedHeaders(Arrays.asList("X-Requested-With", "Origin", "Content-Type", "Accept", "Authorization"));
    configuration.setAllowCredentials(true);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

}`

会话很好地保存在mongodb中，只是没有保存在浏览器中的id。知道吗？

编辑

在httpClient参数中设置observer：“response”时，我看不到Set-Cookie头：

“cache-control：no-cache,no-store,max-age=0,must-revalidate,content-type：application/json,expires：0,pragma：no-cache”

但在开发人员工具中,我有：

HTTP/1.1 200 vary：Origin：Access-Control-Request-Method vary：Access-Control-Request-Headers access-control-allow-origin：http：//localhost:4200 access-control-allow-credentials：true x-content-type-options：nosniff x-xss-protection：1；mode=blockcache-control：no-cache,no-store,max-age=0,must-revalidate pragma：no-cache过期：0 x-frame-options：DENY set-cookie:session=ytewotnknjatzji4ms00zmm2lwexymetyza5nzjhmjayntjh；路径=/；HttpOnly；samesite=lax content-type：application/json transfer-encoding：chunked date：Mon,01 Jul 2019 11:25:08 GMT

Answer 1

问题在角边！我添加了一个拦截器，添加了withCredentials参数，它可以工作。

@Injectable()
export class XhrInterceptor implements HttpInterceptor {

  intercept(req: HttpRequest<any>, next: HttpHandler) {
    const xhr = req.clone({
      withCredentials: true
    });
    return next.handle(xhr);
  }
}