# 1.项目未添加Security依赖
前端地址: http://localhost:9528
后端地址: http://localhost:8889
- 前端调用接口
localhost:8888/user/login - 对于非简单请求，浏览器首先会发起一个OPTIONS预检请求，询问服务器，当前网页所在的域名是否在服务器的许可名单之中，以及可以使用哪些HTTP动词和头信息字段。只有得到肯定答复，浏览器才会发出正式的XMLHttpRequest请求，否则就报错。
控制台:
- 出现了跨域情况
# 解决方案 1
在filter中添加白名单，完整filter代码⤵️
package com.futao.springmvcdemo.foundation; import org.apache.commons.lang3.StringUtils; import org.springframework.http.MediaType; import javax.servlet.*; import javax.servlet.annotation.WebFilter; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; import java.util.ArrayList; /** * @author futao * Created on 2018/9/19-15:47. */ @WebFilter(filterName = "AppFilter", urlPatterns = "/*") public class AppFilter implements Filter { @Override public void destroy() { } @Override public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException { HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) resp; request.setCharacterEncoding("UTF-8"); response.setCharacterEncoding("UTF-8"); response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE); ArrayList<String> allowOrigins = (ArrayList<String>) req.getServletContext().getAttribute("allowOrigins"); String origin = request.getHeader("Origin"); if (allowOrigins.contains(origin)) { response.setHeader("Access-Control-Allow-Origin", origin); } // Access-Control-Max-Age response.setHeader("Access-Control-Max-Age", "3600"); // Access-Control-Allow-Credentials response.setHeader("Access-Control-Allow-Credentials", "true"); // Access-Control-Allow-Methods response.setHeader("Access-Control-Allow-Methods", "PUT,POST, GET, OPTIONS, DELETE"); response.setHeader("Access-Control-Allow-Headers", "Content-Type"); chain.doFilter(req, resp); } @Override public void init(FilterConfig config) throws ServletException { //白名单 ArrayList<String> allowOrigins = new ArrayList<>(); allowOrigins.add("http://localhost:63343"); allowOrigins.add("http://localhost:9528"); config.getServletContext().setAttribute("allowOrigins", allowOrigins); } }
- 再次发起请求
- OK了
- 随后浏览器会自动发起原请求
# 解决方案 2
- 新建CorsConfiguration配置类，自己百度
# 3
@SpringBootConfiguration public class WebMvcConfiguration implements WebMvcConfigurer @Override public void addCorsMappings(CorsRegistry registry) { registry.addMapping("/**") .allowCredentials(true) .allowedMethods("*") .allowedHeaders("Content-Type") .allowedOrigins(SystemConfiguration.ALLOWORIGINS) .maxAge(SystemConfiguration.ORIGINMAXAGE); }
# 2.项目添加了Security依赖
需要额外添加如下配置
package com.futao.springmvcdemo.foundation; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpMethod; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; /** * @author futao * Created on 2018/11/6. */ @Configuration @EnableWebSecurity public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .csrf().disable() .authorizeRequests() .antMatchers(HttpMethod.OPTIONS, "/**").permitAll() .antMatchers("/resources/**").permitAll() .anyRequest().authenticated() .and() .formLogin() .and() .httpBasic(); } @Override public void configure(WebSecurity web) throws Exception { web .ignoring() .antMatchers(HttpMethod.OPTIONS, "/**"); } }
如果同时进行了filter和CorsConfiguration的配置，OPTIONS请求会返回403，并且控制台提示It does not have HTTP ok status.，非常恶心。
疑问：OPTIONS请求到达服务器后是谁做出的响应
