如何从另一个来源访问 url?预检请求 returns 401 即使存在 Access-Control-Allow-* headers
How to access url from another origin? Preflight request returns 401 even if Access-Control-Allow-* headers is present
我 运行 在具有基本身份验证的嵌入式码头中使用简单的 Jersey REST 端点,并尝试通过来自其他 web-application 的 ajax 调用来访问它。但是即使 Access-Control-Allow-* headers 存在,我也会在预检请求中得到 401 Unauthorized。
服务器代码:
public final class RESTServerStarter {
private static final int WEB_SERVER_PORT = 8888;
public static void main(String[] args) throws Exception {
final ServletHolder sh = new ServletHolder(ServletContainer.class);
sh.setInitParameter(ServletContainer.RESOURCE_CONFIG_CLASS, PackagesResourceConfig.class.getCanonicalName());
sh.setInitParameter(PackagesResourceConfig.PROPERTY_PACKAGES, HelloRESTService.class.getPackage().getName());
final ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
context.setSecurityHandler(basicAuth("admin", "adminpwd", "Private!"));
context.setContextPath("/rest");
context.addServlet(sh, "/*");
context.addFilter(MyFilter.class, "/*", EnumSet.of(DispatcherType.REQUEST));
final Server server = new Server();
final ServerConnector connector = new ServerConnector(server);
connector.setHost("172.18.133.20");
connector.setPort(WEB_SERVER_PORT);
server.addConnector(connector);
server.setHandler(context);
try {
server.start();
server.join();
} finally {
server.destroy();
}
}
private static final SecurityHandler basicAuth(String username, String password, String realm) {
HashLoginService hashLoginService = new HashLoginService();
hashLoginService.putUser(username, Credential.getCredential(password), new String[]{"user"});
hashLoginService.setName(realm);
Constraint constraint = new Constraint();
constraint.setName(Constraint.__BASIC_AUTH);
constraint.setRoles(new String[]{"user"});
constraint.setAuthenticate(true);
ConstraintMapping cm = new ConstraintMapping();
cm.setConstraint(constraint);
cm.setPathSpec("/*");
ConstraintSecurityHandler csh = new ConstraintSecurityHandler();
csh.setAuthenticator(new BasicAuthenticator());
csh.setRealmName("myrealm");
csh.addConstraintMapping(cm);
csh.setLoginService(hashLoginService);
return csh;
}
public static final class MyFilter implements Filter {
public void init(FilterConfig filterConfig) {
//nothing to init
}
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
final HttpServletResponse httpResponse = (HttpServletResponse) response;
httpResponse.addHeader("Access-Control-Allow-Origin", "http://172.18.133.20:" + RESTClientStarter.WEB_SERVER_PORT);
httpResponse.addHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS, DELETE, PUT");
httpResponse.addHeader("Access-Control-Allow-Credentials", "true");
httpResponse.addHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization");
chain.doFilter(request, response);
}
public void destroy() {
//nothing to destroy
}
}
@Path("/test")
public static class HelloRESTService {
@GET
@Path("hello")
@Produces(MediaType.TEXT_PLAIN)
public String hello() {
return "hello";
}
}
}
客户代码:
$(function(){
$.ajax({
url : "http://172.18.133.20:8888/rest/test/hello",
type : "GET",
timeout : 120000,
async : true,
xhrFields: {
withCredentials: true
},
crossDomain: true,
headers: {
"Authorization": "Basic " + btoa("admin:adminpwd")
},
error: function(xhr, status, error) {
$("#container").text(error);
},
success: function(xhr) {
$("#container").text(xhr);
}
});
});
客户代码 运行 http://172.18.133.20:9999
这是完整的来源:
https://bitbucket.org/dmitry_apanasevich/cors/src
你能告诉我哪里出了问题吗?
感谢提前!
我认为你使用 httpResponse.addHeader("Access-Control-Allow-Origin", "http://172.18.133.20:" + RESTClientStarter.WEB_SERVER_PORT);
并且您的其余应用程序的 WEB_SERVER_PORT 是 9999,因此 httpResponse 允许 http://172.18.133.20:9999。
但是你在8888端口调用它是不允许的。
我已经解决了从安全映射中排除 OPTIONS 请求的问题。只需添加一行:
...
ConstraintMapping cm = new ConstraintMapping();
cm.setMethod("GET"); //new line
cm.setConstraint(constraint);
cm.setPathSpec("/*");
...
我 运行 在具有基本身份验证的嵌入式码头中使用简单的 Jersey REST 端点,并尝试通过来自其他 web-application 的 ajax 调用来访问它。但是即使 Access-Control-Allow-* headers 存在,我也会在预检请求中得到 401 Unauthorized。
服务器代码:
public final class RESTServerStarter {
private static final int WEB_SERVER_PORT = 8888;
public static void main(String[] args) throws Exception {
final ServletHolder sh = new ServletHolder(ServletContainer.class);
sh.setInitParameter(ServletContainer.RESOURCE_CONFIG_CLASS, PackagesResourceConfig.class.getCanonicalName());
sh.setInitParameter(PackagesResourceConfig.PROPERTY_PACKAGES, HelloRESTService.class.getPackage().getName());
final ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
context.setSecurityHandler(basicAuth("admin", "adminpwd", "Private!"));
context.setContextPath("/rest");
context.addServlet(sh, "/*");
context.addFilter(MyFilter.class, "/*", EnumSet.of(DispatcherType.REQUEST));
final Server server = new Server();
final ServerConnector connector = new ServerConnector(server);
connector.setHost("172.18.133.20");
connector.setPort(WEB_SERVER_PORT);
server.addConnector(connector);
server.setHandler(context);
try {
server.start();
server.join();
} finally {
server.destroy();
}
}
private static final SecurityHandler basicAuth(String username, String password, String realm) {
HashLoginService hashLoginService = new HashLoginService();
hashLoginService.putUser(username, Credential.getCredential(password), new String[]{"user"});
hashLoginService.setName(realm);
Constraint constraint = new Constraint();
constraint.setName(Constraint.__BASIC_AUTH);
constraint.setRoles(new String[]{"user"});
constraint.setAuthenticate(true);
ConstraintMapping cm = new ConstraintMapping();
cm.setConstraint(constraint);
cm.setPathSpec("/*");
ConstraintSecurityHandler csh = new ConstraintSecurityHandler();
csh.setAuthenticator(new BasicAuthenticator());
csh.setRealmName("myrealm");
csh.addConstraintMapping(cm);
csh.setLoginService(hashLoginService);
return csh;
}
public static final class MyFilter implements Filter {
public void init(FilterConfig filterConfig) {
//nothing to init
}
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
final HttpServletResponse httpResponse = (HttpServletResponse) response;
httpResponse.addHeader("Access-Control-Allow-Origin", "http://172.18.133.20:" + RESTClientStarter.WEB_SERVER_PORT);
httpResponse.addHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS, DELETE, PUT");
httpResponse.addHeader("Access-Control-Allow-Credentials", "true");
httpResponse.addHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization");
chain.doFilter(request, response);
}
public void destroy() {
//nothing to destroy
}
}
@Path("/test")
public static class HelloRESTService {
@GET
@Path("hello")
@Produces(MediaType.TEXT_PLAIN)
public String hello() {
return "hello";
}
}
}
客户代码:
$(function(){
$.ajax({
url : "http://172.18.133.20:8888/rest/test/hello",
type : "GET",
timeout : 120000,
async : true,
xhrFields: {
withCredentials: true
},
crossDomain: true,
headers: {
"Authorization": "Basic " + btoa("admin:adminpwd")
},
error: function(xhr, status, error) {
$("#container").text(error);
},
success: function(xhr) {
$("#container").text(xhr);
}
});
});
客户代码 运行 http://172.18.133.20:9999
这是完整的来源:
https://bitbucket.org/dmitry_apanasevich/cors/src
你能告诉我哪里出了问题吗?
感谢提前!
我认为你使用 httpResponse.addHeader("Access-Control-Allow-Origin", "http://172.18.133.20:" + RESTClientStarter.WEB_SERVER_PORT); 并且您的其余应用程序的 WEB_SERVER_PORT 是 9999,因此 httpResponse 允许 http://172.18.133.20:9999。 但是你在8888端口调用它是不允许的。
我已经解决了从安全映射中排除 OPTIONS 请求的问题。只需添加一行:
...
ConstraintMapping cm = new ConstraintMapping();
cm.setMethod("GET"); //new line
cm.setConstraint(constraint);
cm.setPathSpec("/*");
...