跨源请求已阻止：同源策略禁止读取远程资源（访问控制允许源不匹配＆＃39;（null）＆＃39;）

Question

Angular 2.0应用程序正在尝试与Rest Server进行交互，从而降低了CORS问题

以下是我的CORSFilter实现

response.setHeader("Access-Control-Allow-Origin", "http://localhost:3000");
        response.setHeader("Access-Control-Allow-Methods", request.getMethod());
        response.setHeader("Access-Control-Allow-Credentials", "true");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", request.getHeader("Access-Control-Request-Headers"));

        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else {
            chain.doFilter(req, res);
        }

如果我在本地部署（客户端在3000端口上，服务器在8080上），那么令人惊讶的是相同的war文件它工作正常，在本地我没有获得 access-control-allow-credentials 和< strong> access-control-expose-headers ，如果我们在服务器中部署它，我会得到那些标题和CORS问题。

更新：我们部署在不同的服务器，http：//应用程序工作正常，因为它在https：//

上抛出错误

Answer 1

修改Access-Control-Allow-Origin

<?xml version="1.0" encoding="utf-8"?>

<favorites xmlns:launcher="http://schemas.android.com/apk/res-auto/com.android.launcher3">
    <appwidget
        launcher:className="com.android.alarmclock.AnalogAppWidgetProvider"
        launcher:packageName="com.android.deskclock"
        launcher:screen="3"
        launcher:spanX="2"
        launcher:spanY="2"
        launcher:x="1"
        launcher:y="0"/>

   <appwidget
    launcher:packageName="com.android.settings"
    launcher:className="com.android.settings.widget.SettingsAppWidgetProvider"
    launcher:screen="1"
    launcher:x="0"
    launcher:y="3"
    launcher:spanX="4"
    launcher:spanY="1" />


    <favorite
        launcher:className="com.android.settings.Settings"
        launcher:container="-100"
        launcher:packageName="com.android.settings"
        launcher:screen="0"
        launcher:x="0"
        launcher:y="1"/>
    <favorite
        launcher:className="com.android.settings.Settings"
        launcher:container="-100"
        launcher:packageName="com.android.settings"
        launcher:screen="4"
        launcher:x="3"
        launcher:y="1"/>

    <favorite
        launcher:className="com.android.vending.AssetBrowserActivity"
        launcher:container="-101"
        launcher:packageName="com.android.vending"
        launcher:screen="0"
        launcher:x="0"
        launcher:y="0"/>
    <favorite
        launcher:className="com.android.contacts.activities.PeopleActivity"
        launcher:container="-101"
        launcher:packageName="com.android.contacts"
        launcher:screen="1"
        launcher:x="1"
        launcher:y="0"/>
</favorites>

并且，允许所有HttpMethod.OPTIONS请求。

 response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));

@ ramesh-kotha，有关详细信息，请查看CORS OPTION and GET