在Tomcat中设置CORS标头

Question

我有一个由Tomcat托管的静态网站。

如何为我的网站设置标头，例如：Access-Control-Allow-Origin：*

它们都是静态文件，而不是任何servlet应用程序。

Answer 1

请注意，要使用值配置CORS筛选器，除了启用文件管理器外，还需要为参数添加配置

 <!-- ================== Built In Filter Definitions ===================== -->

  ...

 <filter>
   <filter-name>CorsFilter</filter-name>
   <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
   <init-param>
     <param-name>cors.allowed.origins</param-name>
     <param-value>*</param-value>
   </init-param>
 </filter>
 <filter-mapping>
   <filter-name>CorsFilter</filter-name>
   <url-pattern>/*</url-pattern>
 </filter-mapping>

<!-- ==================== Built In Filter Mappings ====================== -->

Answer 2

下面是一个非常基本的过滤器，它将添加CORS标题。请注意，默认情况下，这将启用所有域和方法，因此您应该自定义它以满足您的需要。

它还需要成为web中的第一个过滤器。xml。

package com.conductiv.api.listener;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class CORSFilter implements Filter {
    public void destroy() {
    }
    public static String VALID_METHODS = "DELETE, HEAD, GET, OPTIONS, POST, PUT";

    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException {
        HttpServletRequest httpReq = (HttpServletRequest) req;
        HttpServletResponse httpResp = (HttpServletResponse) resp;

        // No Origin header present means this is not a cross-domain request
        String origin = httpReq.getHeader("Origin");
         if (origin == null) {
            // Return standard response if OPTIONS request w/o Origin header
           if ("OPTIONS".equalsIgnoreCase(httpReq.getMethod())) {
                httpResp.setHeader("Allow", VALID_METHODS);
                httpResp.setStatus(200);
                return;
            }
        } else {
            // This is a cross-domain request, add headers allowing access
            httpResp.setHeader("Access-Control-Allow-Origin", origin);
            httpResp.setHeader("Access-Control-Allow-Methods", VALID_METHODS);

            String headers = httpReq.getHeader("Access-Control-Request-Headers");
            if (headers != null)
                httpResp.setHeader("Access-Control-Allow-Headers", headers);

            // Allow caching cross-domain permission
            httpResp.setHeader("Access-Control-Max-Age", "3600");
        }
        // Pass request down the chain, except for OPTIONS
        if (!"OPTIONS".equalsIgnoreCase(httpReq.getMethod())) {
            chain.doFilter(req, resp);
        }
 }

    public void init(FilterConfig config) throws ServletException {

    }

}

Answer 3

如果是静态站点，那么从Tomcat 7.0.41开始，您可以通过内置过滤器轻松控制CORS行为。

参考文献：

• 雄猫7
• 雄猫9

几乎你唯一要做的就是在CATALINA_HOME/conf中编辑全局web.xml并添加过滤器定义：

     <!-- ================== Built In Filter Definitions ===================== -->

      ...

     <filter>
       <filter-name>CorsFilter</filter-name>
       <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
     </filter>
     <filter-mapping>
       <filter-name>CorsFilter</filter-name>
       <url-pattern>/*</url-pattern>
     </filter-mapping>

    <!-- ==================== Built In Filter Mappings ====================== -->

不过，请注意，Firefox不喜欢访问控制允许来源：和具有凭据的请求（cookie）：当响应具有凭据的请求时，服务器必须指定域，并且不能使用通配符。

（tomcat.apache.org/tomcat-8.0-doc/images/cors-flowchart.png）