Question

我有一个CORS配置：

  @Bean
  CorsConfigurationSource corsConfigurationSource() {
    LOGGER.info("Configuring CORS");
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("http://localhost:3000", "https://localhost:3000", "http://localhost:2199", "https://localhost:2199"));
    configuration.setAllowCredentials(true);
    configuration.setAllowedHeaders(
        Arrays.asList("Access-Control-Allow-Headers",
            "Access-Control-Allow-Origin", "Access-Control-Request-Method",
            "Access-Control-Request-Headers", "Origin", "Cache-Control",
            "Content-Type", "Authorization", "Accept"));
    configuration.setAllowedMethods(
        Arrays.asList("DELETE", "GET", "POST", "PATCH", "PUT"));
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
  }

这适用于此请求：

curl -v -XOPTIONS -H 'Access-Control-Request-Headers: content-type' -H 'Origin: http://localhost:3001' http://localhost:8080/auth/create-account

它返回200

如果我添加Access-Control-Request-Method: POST

，它将不起作用

curl -v -XOPTIONS -H 'Access-Control-Request-Headers: content-type' -H 'Origin: http://localhost:3001' http://localhost:8080/auth/create-account -H 'Access-Control-Request-Method: POST'

这是控制器：

@RestController
@RequestMapping("/auth")
public class AuthEndpoint {

@PostMapping("/login")
  public ResponseEntity<Object> doLogin(@RequestBody @Valid LoginDTO loginDTO) {
    LOGGER.debug("Attempting login {}", loginDTO);
    try {
    .....

Spring的日志说：

2019-01-01 21:16:35.100 DEBUG 24848 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : OPTIONS "/auth/create-account", parameters={}
2019-01-01 21:16:35.104 DEBUG 24848 --- [nio-8080-exec-1] s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to public org.springframework.http.ResponseEntity<java.lang.Object> rest.AuthEndpoint.createAccount(NewAccountDTO)
2019-01-01 21:16:35.106 DEBUG 24848 --- [nio-8080-exec-1] o.j.s.OpenEntityManagerInViewInterceptor : Opening JPA EntityManager in OpenEntityManagerInViewInterceptor
2019-01-01 21:16:35.112 DEBUG 24848 --- [nio-8080-exec-1] o.j.s.OpenEntityManagerInViewInterceptor : Closing JPA EntityManager in OpenEntityManagerInViewInterceptor
2019-01-01 21:16:35.112 DEBUG 24848 --- [nio-8080-exec-1] o.s.orm.jpa.EntityManagerFactoryUtils    : Closing JPA EntityManager
2019-01-01 21:16:35.112 DEBUG 24848 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Completed 403 FORBIDDEN

看起来调度程序servlet正在拦截它并杀死它，但是仅使用Access-Control-Request-Method头，没有该头，它就可以工作。

现在，如果我更改控制器以添加以下内容：@CrossOrigin(origins = "http://localhost:3000")两种方法都可以使用。

我的问题是如何全局配置我的整个应用程序，以避免必须用（{应该是多余的）@CrossOrigin注释来修饰每个REST控制器？

Answer 1

我在that blog post和Spring Framework reference documentation中描述了Spring MVC全局CORS配置。

如果您enable CORS support at Spring Security level，Spring Security将自动检测Spring MVC CORS配置并利用它来授权请求。

Answer 2

同一问题使我们有些头疼，但是我们设法找到了Spring-Boot v2.3.3的解决方案。这里的问题是，只要您有一个带有Origin和Access-control-request-method标头的Options请求，就可以正常工作。

在WebMvcConfigurer中配置CORS。
在OPTIONS中定义allowedMethods。
请勿添加任何其他CorsFilter。

例如

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedOrigins("*")
                .allowedMethods(HttpMethod.GET.name(), HttpMethod.HEAD.name(),
                                HttpMethod.OPTIONS.name(), HttpMethod.POST.name())
                .maxAge(1000L); // in seconds
    }
}

但是，我们还使用了Swagger v2.9.2，由于某些奇怪的原因，上述WebMvcConfigurer并未为Swagger /v2/api-docs端点启用CORS。在this answer中找到的解决方案是添加一个CorsFilter bean例如

@Bean
public CorsFilter corsFilterSwagger() {
    CorsConfiguration config = new CorsConfiguration();
    config.addAllowedOrigin("*");
    config.setMaxAge(1000L);

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/v2/api-docs", config);
    return new CorsFilter(source);
}

问题在于，一旦我们添加了此选项，“选项”请求就会再次开始失败。最终，我们将Swagger升级到了3.0.0版本，该版本解决了端点的CORS问题，因此在删除CorsFilter之后，一切正常。

Answer 3

在允许的方法中添加“选项”

  response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
    response.setHeader("Access-Control-Allow-Credentials", "true");
    response.setHeader("Access-Control-Allow-Methods", "POST, PUT, PATCH, GET, OPTIONS, DELETE");
    response.setHeader("Access-Control-Max-Age", "3600");
    response.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me, Authorization, User-Accept-Language");
    if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
    } else {
            chain.doFilter(req, res);
    }

Spring Boot CORS配置问题-Access-Control-Request-Method：POST

3 个答案: