CORS跨域资源共享(二)：详解Spring MVC对CORS支持的相关类和API【享学Spring MVC】(下)

// @since 4.2
public class CorsFilter extends OncePerRequestFilter {
  private final CorsConfigurationSource configSource;
  // 默认使用的DefaultCorsProcessor，当然你也可以自己指定
  private CorsProcessor processor = new DefaultCorsProcessor();
  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    // 只处理跨域请求
    if (CorsUtils.isCorsRequest(request)) {
      // Spring这里有个bug：因为它并不能保证configSource肯定被初始化了
      CorsConfiguration corsConfiguration = this.configSource.getCorsConfiguration(request);
      if (corsConfiguration != null) {
        boolean isValid = this.processor.processRequest(corsConfiguration, request, response);
        // 若处理后返回false，或者该请求本身就是个Options请求，那后面的Filter也不要处理了~~~~~
        if (!isValid || CorsUtils.isPreFlightRequest(request)) {
          return;
        }
      }
    }
    filterChain.doFilter(request, response);
  }
}

// @since 4.2 可使用在类上和方法上
@Target({ ElementType.METHOD, ElementType.TYPE })
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface CrossOrigin {
  // 下面4个属性在5.0后都被此方法所代替 因为此方法默认会被执行
  /** @deprecated as of Spring 5.0, in favor of {@link CorsConfiguration#applyPermitDefaultValues} */
  @Deprecated
  String[] DEFAULT_ORIGINS = { "*" };
  @Deprecated
  String[] DEFAULT_ALLOWED_HEADERS = { "*" };
  @Deprecated
  boolean DEFAULT_ALLOW_CREDENTIALS = false;
  @Deprecated
  long DEFAULT_MAX_AGE = 1800;
  // 若需要通配，可写*
  @AliasFor("origins")
  String[] value() default {};
  @AliasFor("value")
  String[] origins() default {};
  String[] allowedHeaders() default {};
  String[] exposedHeaders() default {};
  RequestMethod[] methods() default {};
  String allowCredentials() default "";
  long maxAge() default -1; // 负值意味着不生效 By default this is set to {@code 1800} seconds (30 minutes)
}

public class CorsRegistry {
  // 保存着全局的配置，每个CorsRegistration就是URL pattern和CorsConfiguration配置
  private final List<CorsRegistration> registrations = new ArrayList<>();
  // 像上面List添加一个全局配置（和pathPattern绑定）
  // 它使用的是new CorsRegistration(pathPattern)
  // 可见使用配置是默认配置：new CorsConfiguration().applyPermitDefaultValues()
  // 当然它CorsRegistration return给你了，你还可以改（配置）的~~~~
  public CorsRegistration addMapping(String pathPattern) {
    CorsRegistration registration = new CorsRegistration(pathPattern);
    this.registrations.add(registration);
    return registration;
  }
  // 这个就比较简单了：把当前List专程Map。key就是PathPattern~~~~
  protected Map<String, CorsConfiguration> getCorsConfigurations() {
    Map<String, CorsConfiguration> configs = new LinkedHashMap<>(this.registrations.size());
    for (CorsRegistration registration : this.registrations) {
      configs.put(registration.getPathPattern(), registration.getCorsConfiguration());
    }
    return configs;
  }
}