响应中的“访问控制允许凭据”标头为“”，必须为“true”

Question

我正在尝试向RESTAPI发送评论。rest API已经为我的应用程序地址设置了CORS。。

后端

@RestController
@CrossOrigin(origins = "http://localhost:8000", allowedHeaders = "*", methods = {RequestMethod.GET,RequestMethod.POST,RequestMethod.DELETE,RequestMethod.PUT})
@RequestMapping("/api")
public class CommentController {

    @Autowired
    private CommentRepository commentRepository;

    // Get All Comments From a certain workitemId
    @GetMapping("/comments/{workitemId}")
    public List<Comment> getTicketHistory(@PathVariable Long workitemId) {
        return commentRepository.getCommentsByWorkitemId(workitemId);
    }

    // Create a comment related with a given Workitem
    @PostMapping("/comment")
    public boolean createComment(@RequestBody Comment comment) {
        commentRepository.save(comment);
        return true;
    }
}

但我得到了

加载失败http://localhost:8999/api/comment: 对飞行前请求的响应未通过访问控制检查：响应中“访问控制允许凭据”标头的值为“”，当请求的凭据模式为“包括”时，该值必须为“真”。起源'http://localhost:8000因此，不允许访问。XMLHttpRequest启动的请求的凭据模式由withCredentials属性控制。

我的代码：

$http.post(baseUrl + "/comment", vm.comment).then(
      function(response) {
        // success callback
        console.log("Comment Submitted!");
      },
      function(response) {
        // failure call back
         console.log("Error while submitting the comment");
      });

Answer 1

您忘记添加：

allowCredentials=true

它应该是：

@CrossOrigin(origins = "http://localhost:8000", allowCredentials = "true", allowedHeaders = "*", methods = {RequestMethod.GET,RequestMethod.POST,RequestMethod.DELETE,RequestMethod.PUT})

Answer 2

尝试在@CrossOrigin注释中添加allowCredentials=“true”，如下所示：，

@CrossOrigin(
    allowCredentials = "true",
    origins = "http://localhost:8000", 
    allowedHeaders = "*", 
    methods = {RequestMethod.GET,RequestMethod.POST,RequestMethod.DELETE,RequestMethod.PUT}
)

这可能有用。