无法在Spring Boot应用程序提供的响应中设置'Access-Control-Allow-Origin'标头

Question

The value of the 'Access-Control-Allow-Origin' header in the response must 
not be the wildcard '*' when the request's credentials mode is 'include'. 
Origin 'http://localhost:4200' is therefore not allowed access. The 
credentials mode of requests initiated by the XMLHttpRequest is controlled by 
the withCredentials attribute.

let headers = new Headers({
"Content-Type": "application/x-www-form-urlencoded"});
let options = new RequestOptions({ headers: headers ,withCredentials:true});

//body contains username and password.
this.http.post('http://localhost:8080/login',{body}, options).
subscribe(response => {
    console.log(response)    
});

@CrossOrigin(origins = "http://localhost:4200",allowCredentials="true")
@RestController
public class SecurityApplication {
...  //Rest Api's
}
//Security Config
protected void configure(HttpSecurity http) throws Exception {
    http.
        cors().and().httpBasic().and().formLogin()
        .and()
        .authorizeRequests()
            .antMatchers( "/", "/home", "/login").permitAll()
            .anyRequest().authenticated();
}

我参考了https://www.concretepage.com/spring-4/spring-4-rest-cors-integration-using-crossorigin-annotation-xml-filter-example，根据它，orgins=“http://localhost:4200”应该将响应头中的access-control-allog-orgin设置为提供给它的值，但我仍然得到通配符'*'作为响应。

我试过corsFilters，但不起作用。我在Chrome浏览器中启用了CORS扩展。我想知道为什么它没有将Access-Control-Allow-Origin设置为我提供的值，以及如何解决它。

Answer 1

一种方法是不设置交叉原点。相反，在您的angular应用程序中，创建一个代理文件proxy.conf.json，当启动您的angular时，使用

ng serve --proxy-conf proxy.conf.json

那么proxy.conf.json的内容将是：

{
    "/api": {
        "target": "http://localhost:8080/api",
        "secure": false,
        "changeOrigin": "true",
        "pathRewrite": {
            "^/api": ""
        } 
    }
}

最后，在spring boot application中的application.Properties中，您可以设置：

server.context-path=/api

this.http.post('/api/login',{body}, options).subscribe(response => {
    console.log(response)    
});