为什么我的 CORS 过滤器不起作用? Spring 开机
Why my CORS filters don't work? Spring Boot
我的后端设置在 REST 控制器上的 CORS 方面存在很大问题。我尝试应用各种过滤器,其中 none 有效。
这是我当前的 CORS 过滤器实现
import lombok.extern.slf4j.Slf4j;
import org.springframework.context.annotation.Bean;
import org.springframework.stereotype.Component;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.cors.reactive.CorsWebFilter;
import org.springframework.web.filter.CorsFilter;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;
@Slf4j
@Component
public class CORSFilter implements Filter {
@Bean
public CorsFilter corsFilter() {
final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
final CorsConfiguration config = new CorsConfiguration();
config.setAllowedHeaders(Arrays.asList("Origin", "Content-Type", "Accept", "authorization"));
config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "OPTIONS", "DELETE", "PATCH"));
config.setAllowedOriginPatterns(Collections.singletonList("*"));
config.setAllowCredentials(true);
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
HttpServletResponse response = (HttpServletResponse) servletResponse;
response.setHeader("Access-Control-Allow-Origin", "http://localhost:3000");
response.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, OPTIONS, DELETE, PATCH");
response.setHeader("Access-Control-Max-Age", "3600");
response.setHeader("Access-Control-Allow-Headers", "Origin, Content-Type, Accept");
response.setHeader("Access-Control-Allow-Credentials", "true");
servletRequest.getParameterMap();
filterChain.doFilter(servletRequest, servletResponse);
}
}
因为它不起作用,我还添加了 CORS 配置器
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
public class CORSconfigurer {
@Bean
public WebMvcConfigurer corsConfigurer() {
return new WebMvcConfigurer() {
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/customer").allowedOrigins("http://localhost:3000");
registry.addMapping("/promotion").allowedOrigins("http://localhost:3000");
}
};
}
}
也没用。
我将 CORS 注释应用于每个控制器
@RestController
@RequestMapping("/beacon")
@RequiredArgsConstructor
@CrossOrigin
public class BeaconController {
还是没有用。
Error is this: Access to XMLHttpRequest at 'my-domain.dev/api-cms/customer/…' from origin 'localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
这个问题困扰了我几个星期,我不知道该怎么办了。我非常感谢这里的好建议。
我不明白为什么要创建一个额外的过滤器,因为通常实施 WebMvcConfigurer
就足够了 - 至少根据我的知识和经验。
您是否尝试过以下配置,例如:
@Configuration
public class WebConfig extends WebMvcAutoConfiguration implements WebMvcConfigurer {
// Spring Boot 2.3.9.RELEASE
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins(CorsConfiguration.ALL)
.allowedMethods(CorsConfiguration.ALL)
.allowedHeaders(CorsConfiguration.ALL)
.exposedHeaders("Location")
.allowCredentials(true);
}
}
我知道这个配置并不完美,因为你允许每个来源。然而,这是一个很好的起点,并且在过去为我提供了快速原型。
干杯
我的后端设置在 REST 控制器上的 CORS 方面存在很大问题。我尝试应用各种过滤器,其中 none 有效。 这是我当前的 CORS 过滤器实现
import lombok.extern.slf4j.Slf4j;
import org.springframework.context.annotation.Bean;
import org.springframework.stereotype.Component;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.cors.reactive.CorsWebFilter;
import org.springframework.web.filter.CorsFilter;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;
@Slf4j
@Component
public class CORSFilter implements Filter {
@Bean
public CorsFilter corsFilter() {
final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
final CorsConfiguration config = new CorsConfiguration();
config.setAllowedHeaders(Arrays.asList("Origin", "Content-Type", "Accept", "authorization"));
config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "OPTIONS", "DELETE", "PATCH"));
config.setAllowedOriginPatterns(Collections.singletonList("*"));
config.setAllowCredentials(true);
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
HttpServletResponse response = (HttpServletResponse) servletResponse;
response.setHeader("Access-Control-Allow-Origin", "http://localhost:3000");
response.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, OPTIONS, DELETE, PATCH");
response.setHeader("Access-Control-Max-Age", "3600");
response.setHeader("Access-Control-Allow-Headers", "Origin, Content-Type, Accept");
response.setHeader("Access-Control-Allow-Credentials", "true");
servletRequest.getParameterMap();
filterChain.doFilter(servletRequest, servletResponse);
}
}
因为它不起作用,我还添加了 CORS 配置器
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
public class CORSconfigurer {
@Bean
public WebMvcConfigurer corsConfigurer() {
return new WebMvcConfigurer() {
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/customer").allowedOrigins("http://localhost:3000");
registry.addMapping("/promotion").allowedOrigins("http://localhost:3000");
}
};
}
}
也没用。 我将 CORS 注释应用于每个控制器
@RestController
@RequestMapping("/beacon")
@RequiredArgsConstructor
@CrossOrigin
public class BeaconController {
还是没有用。
Error is this: Access to XMLHttpRequest at 'my-domain.dev/api-cms/customer/…' from origin 'localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
这个问题困扰了我几个星期,我不知道该怎么办了。我非常感谢这里的好建议。
我不明白为什么要创建一个额外的过滤器,因为通常实施 WebMvcConfigurer
就足够了 - 至少根据我的知识和经验。
您是否尝试过以下配置,例如:
@Configuration
public class WebConfig extends WebMvcAutoConfiguration implements WebMvcConfigurer {
// Spring Boot 2.3.9.RELEASE
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins(CorsConfiguration.ALL)
.allowedMethods(CorsConfiguration.ALL)
.allowedHeaders(CorsConfiguration.ALL)
.exposedHeaders("Location")
.allowCredentials(true);
}
}
我知道这个配置并不完美,因为你允许每个来源。然而,这是一个很好的起点,并且在过去为我提供了快速原型。
干杯