Question

我对CORS错误有疑问。我确实要求提供Google oAuth2，但收到CORS错误：我想获得Google身份验证并生成JWT令牌。在不使用客户端的情况下，一切都很好。当我发送角度请求时，这是CORS的问题。我允许所有类型的CORS。为什么会出现此错误？

Access to XMLHttpRequest at 'https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=1020159669873-d9r35ssmnejud852bam87d8gqtcj5qf1.apps.googleusercontent.com&scope=openid%20profile%20email&state=8nizHP1X2z9sA8m0vqM4Lzd6VT24R15eSw5flteTywM%3D&redirect_uri=http://localhost:8080/oauth2/callback/google' (redirected from 'http://localhost:8080/oauth2/authorization/google')
from origin 'null' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Cross-Origin Read Blocking (CORB) blocked cross-origin response https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=1020159669873-d9r35ssmnejud852bam87d8gqtcj5qf1.apps.googleusercontent.com&scope=openid%20profile%20email&state=8nizHP1X2z9sA8m0vqM4Lzd6VT24R15eSw5flteTywM%3D&redirect_uri=http://localhost:8080/oauth2/callback/google with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.

我的Angular请求：

 googleLogin(): Observable<LoginResponse> {
    return this.http.get<LoginResponse>
    (environment.baseUrl + '/oauth2/authorization/google')
      .pipe(tap(response => {
        localStorage.setItem('access_token', response.accessToken);
      }));
  }

//...

public onGoogleLogin(): void {
   this.authService.googleLogin().subscribe();
 }

//...

CORS CONFIG：

 @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry
                .addMapping("/**")
                .allowedOrigins("*")
                .allowedMethods("HEAD", "OPTIONS", "GET", "POST", "PUT", "PATCH", "DELETE")
                .maxAge(MAX_AGE_SECS);
    }

安全配置：

   @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .cors()
                    .and()
                .csrf()
                    .disable()
                .exceptionHandling()
                    .authenticationEntryPoint(unauthorizedHandler)
                    .and()
                .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and()
                .authorizeRequests()
                    .antMatchers("/",
                "/favicon.ico",
                "/**/*.png",
                "/**/*.gif",
                "/**/*.svg",
                "/**/*.jpg",
                "/**/*.html",
                "/**/*.css",
                "/**/*.js")
                        .permitAll()
                .antMatchers("/api/v1/oauth0/**")
                        .permitAll()
                .antMatchers("/api/v1/oauth2/**")
                    .permitAll()
                .anyRequest()
                    .authenticated()
                    .and()
                // włączenie obslugi oauth2
                .oauth2Login()
                .successHandler(this.successHandler)
                .redirectionEndpoint()
                    .baseUri("/oauth2/callback/*")
                    .and()
                .userInfoEndpoint()
                    .oidcUserService(customOidcUserService);
        http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }

成功处理程序：

@Autowired
    private UserRepository userRepository;

    @Autowired
    private JwtTokenProvider tokenProvider;

    private final static String URL = "http://localhost:8080/api/v1/oauth2/authenticate";

    @Override
    public void onAuthenticationSuccess(
            HttpServletRequest request,
            HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {

        if (response.isCommitted()) {
            return; }

        DefaultOidcUser oidcUser = (DefaultOidcUser) authentication.getPrincipal();
        System.out.println(oidcUser);
        Map attributes = oidcUser.getAttributes();
        String email = attributes.get("email").toString();
        User user = userRepository.findByEmail(email).orElseThrow(
                () -> new ResourceNotFoundException("User", "email", email)
        );
        String token = tokenProvider.generateToken(user);
        String redirectionUrl = UriComponentsBuilder.fromUriString(URL).queryParam("token", token)
                .build().toUriString();
        getRedirectStrategy().sendRedirect(request, response, redirectionUrl);
    }
}

控制器：

@RestController
@RequestMapping("/api/v1/oauth2")
public class OAuth2Controller {

    @GetMapping("/authenticate")
    public ResponseEntity<?> authenticateUser(@RequestParam String token) {
        return ResponseEntity.ok(new JwtAuthenticationResponse(token));
    }
}

Answer 1

在此示例中，您无法获取令牌，因为您需要进行实际的重定向。您可以通过几种方法来规避此要求，有关详细信息，请参见RFC https://tools.ietf.org/html/rfc6749#section-1.2

在弹出窗口中启动授权流程，并通过浏览器中提供的<Card name="Card1" data={this.state.cardData1} spinnerFlag={this.state.cardData1 === ""} /> API将服务器收到的令牌从弹出窗口传递回Webapp。
保存状态（无论状态如何），然后重定向到将启动授权流程的服务器，并在交换令牌以获取授权后，使用令牌作为查询字符串参数重定向回Webapp。然后使用它并恢复状态。

OAuth2与Google-CORS错误（Angular + Spring启动）

1 个答案: