CORS跨域资源共享(二)：详解Spring MVC对CORS支持的相关类和API【享学Spring MVC】(上)

// @since 4.2
public class CorsConfiguration {
  // public的通配符：代表所有的源、方法、headers...
  // 若你需要使用通配符，可以使用此静态常量
  public static final String ALL = "*";
  private static final List<HttpMethod> DEFAULT_METHODS = Collections.unmodifiableList(Arrays.asList(HttpMethod.GET, HttpMethod.HEAD));
  // 默认许可所有方法
  private static final List<String> DEFAULT_PERMIT_ALL = Collections.unmodifiableList(Arrays.asList(ALL));
  // 默认许可这三个方法
  private static final List<String> DEFAULT_PERMIT_METHODS = Collections.unmodifiableList(Arrays.asList(HttpMethod.GET.name(), HttpMethod.HEAD.name(), HttpMethod.POST.name()));
  // ==========把这些属性对应上文讲述的响应头们对应，和W3C标注都是对应上的=========
  @Nullable
  private List<String> allowedOrigins;
  @Nullable
  private List<String> allowedMethods;
  @Nullable
  private List<HttpMethod> resolvedMethods = DEFAULT_METHODS;
  @Nullable
  private List<String> allowedHeaders;
  @Nullable
  private List<String> allowedHeaders;
  @Nullable
  private List<String> exposedHeaders;
  @Nullable
  private Boolean allowCredentials;
  @Nullable
  private Long maxAge;
  ... // 省略所有构造函数以及所有的get/set方法
  // 使用此方法将初始化模型翻转为以允许get、head和post请求的所有跨源请求的打开默认值开始
  // 注意：此方法不会覆盖前面set进去的值，所以建议此方法可以作为兜底调用。实际上Spring内部也是用它兜底的
  public CorsConfiguration applyPermitDefaultValues() {
    if (this.allowedOrigins == null) {
      this.allowedOrigins = DEFAULT_PERMIT_ALL;
    }
    if (this.allowedMethods == null) {
      this.allowedMethods = DEFAULT_PERMIT_METHODS;
      this.resolvedMethods = DEFAULT_PERMIT_METHODS.stream().map(HttpMethod::resolve).collect(Collectors.toList());
    }
    if (this.allowedHeaders == null) {
      this.allowedHeaders = DEFAULT_PERMIT_ALL;
    }
    if (this.maxAge == null) {
      this.maxAge = 1800L;
    }
    return this;
  }
  public CorsConfiguration combine(@Nullable CorsConfiguration other) { ... }
  // 根据配置的允许来源检查请求的来源
  // 返回值并不是bool值，而是字符串--> 返回可用的origin。若是null表示请求的origin不被支持
  @Nullable
  public String checkOrigin(@Nullable String requestOrigin) { ... }
  // 检查预检请求的Access-Control-Request-Method这个请求头
  public List<HttpMethod> checkHttpMethod(@Nullable HttpMethod requestMethod) { ... }
  // 检查预检请求的Access-Control-Request-Headers
  @Nullable
  public List<String> checkHeaders(@Nullable List<String> requestHeaders) {
}

public interface CorsConfigurationSource {
  // 找到此request的一个CORS配置
  @Nullable
  CorsConfiguration getCorsConfiguration(HttpServletRequest request);
}

// @since 4.2
public class UrlBasedCorsConfigurationSource implements CorsConfigurationSource {
  // 请务必注意：这里使用的是LinkedHashMap
  private final Map<String, CorsConfiguration> corsConfigurations = new LinkedHashMap<>();
  private PathMatcher pathMatcher = new AntPathMatcher();
  private UrlPathHelper urlPathHelper = new UrlPathHelper();
  ... // 生路所有的get/set方法
  // 这里的path匹配用到的是AntPathMatcher.match()，默认是按照ant风格进行匹配的
  @Override
  @Nullable
  public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {
    String lookupPath = this.urlPathHelper.getLookupPathForRequest(request);
    for (Map.Entry<String, CorsConfiguration> entry : this.corsConfigurations.entrySet()) {
      if (this.pathMatcher.match(entry.getKey(), lookupPath)) {
        return entry.getValue();
      }
    }
    return null;
  }
}