自动为每个响应添加标头

Question

我想在我的应用程序中为休息控制器提出请求以允许跨源资源共享时,将此标头"Access-Control-Allow-Origin","*"添加到客户端的每个响应中当前我手动添加此标题到这样的每个方法

HttpHeaders headers = new HttpHeaders();
headers.add("Access-Control-Allow-Origin", "*");

它的工作,但非常令人沮丧.我在spring docs中找到了webContentInterceptor,它允许我们修改每个响应的头文件

<mvc:interceptors>
<bean id="webContentInterceptor" 
class="org.springframework.web.servlet.mvc.WebContentInterceptor">
<property name="Access-Control-Allow-Origin" value="*"/>
</bean>
</mvc:interceptors>

但是当我使用这个它会引发错误找不到属性名称访问控制允许来源的那么有没有我们可以自动添加标题,每个响应任何其他方式

更新!Spring框架4.2通过将@CrossOrigin注释添加到方法或控制器本身来大大简化了这一点  https://spring.io/blog/2015/06/08/cors-support-in-spring-framework

Answer 1

我最近遇到了这个问题并找到了这个解决方案.您可以使用过滤器添加这些标头:

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.web.filter.OncePerRequestFilter;

public class CorsFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
            response.addHeader("Access-Control-Allow-Origin", "*");
            if (request.getHeader("Access-Control-Request-Method") != null
                    && "OPTIONS".equals(request.getMethod())) {
                // CORS "pre-flight" request
                response.addHeader("Access-Control-Allow-Methods",
                        "GET, POST, PUT, DELETE");
                response.addHeader("Access-Control-Allow-Headers",
                        "X-Requested-With,Origin,Content-Type, Accept");
            }
            filterChain.doFilter(request, response);
    }

}

不要忘记将过滤器添加到弹簧上下文中:

<bean id="corsFilter" class="my.package.CorsFilter" />

和web.xml中的映射:

<filter>
    <filter-name>corsFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>corsFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

为了更进一步,您可以指定一个Spring配置文件来启用或禁用此过滤器:

<beans profile="!cors">
    <bean id="corsFilter" class="my.package.FilterChainDoFilter" />
</beans>

<beans profile="cors">
    <bean id="corsFilter" class="my.package.CorsFilter" />
</beans>

(提供类似于CorsFilter的FilterChainDoFilter,但只能filterChain.doFilter(request, response);在doFilterInternal(..)中执行)

Answer 2

更新!Spring框架4.2通过将@CrossOrigin注释添加到方法或控制器本身来大大简化了这一点 https://spring.io/blog/2015/06/08/cors-support-in-spring-framework

Answer 3

如果要为控制器设置标题,可以使用@ModelAttribute注释.

@ModelAttribute
public void setVaryResponseHeader(HttpServletResponse response) {
    response.setHeader("Vary", "Accept");
}