Tomcat和Android Webview的CORS问题

Question

我遇到了Tomcat 8和CORS的一个奇怪问题.我正在开发一个混合Web应用程序,使用ionicframework,AngularJS,Cordova作为前端,Tomcat 8和Spring 3作为后端.

为了便于开发,我正在测试chrome中的功能,其中工作正常.我添加了标准配置的CORS过滤器,以允许来自浏览器的CROSS ORIGIN请求.

今天我将我的应用程序转换为Android应用程序,并开始向tomcat服务器进行AJAX调用.令我惊讶的是,事情停止了.我在浏览器和Android webview的标题中进一步调试和异常.

浏览器发送2个相同呼叫OPTION和POST的请求.但Android Webview只发送POST请求.

浏览器请求标头:

选项:

Remote Address:54.254.159.166:80
Request URL:http://medistreet.in/auth2
Request Method:OPTIONS
Status Code:200 OK
Request Headers 
OPTIONS /auth2 HTTP/1.1
Host: medistreet.in
Connection: keep-alive
Access-Control-Request-Method: POST
Origin: http://localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
Access-Control-Request-Headers: accept, content-type
Accept: */*
Referer: http://localhost/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8

POST:

Remote Address:54.254.159.166:80
Request URL:http://medistreet.in/auth2
Request Method:POST
Status Code:200 OK

Request Headers
Accept:application/json, text/plain, */*
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Connection:keep-alive
Content-Length:39
Content-Type:application/json;charset=UTF-8
Host:medistreet.in
Origin:http://localhost
Referer:http://localhost/
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36

Android请求标头:

Request URL:http://medistreet.in/auth2
Request Method:POST
Status Code:403 Forbidden
Request Headers
POST http://medistreet.in/auth2 HTTP/1.1
Accept: application/json, text/plain, */*
Origin: file://
User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; XT1033 Build/KXB20.25-1.31) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36
Content-Type: application/json;charset=UTF-8

我看到的区别在于标题数量,特别是包含"file://"的 Origin Header .为了克服这一点,我添加了更多选项是CORS过滤器:

<filter>
        <filter-name>CorsFilter</filter-name>
        <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
            <init-param>
            <param-name>cors.allowed.origins</param-name>
            <param-value>*</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>CorsFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

另一个奇怪的事情是,当我们发送相同的Android请求来自POSTMAN(chrome REST插件)请求的Headers成功.

POSTMAN标题:

Remote Address:54.254.159.166:80
Request URL:http://medistreet.in/auth2
Request Method:POST
Status Code:200 OK
Request Headers
Accept:application/json, text/plain, */*
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Cache-Control:no-cache
Connection:keep-alive
Content-Length:39
Content-Type:application/json;charset=UTF-8
Cookie:fbm_464284963672217=base_domain=.medistreet.in; JSESSIONID=87435755F03D7B045DD6E33D1D16AC51; fbsr_464284963672217=dUjASqF-nWquTFPk_-5wAtI0jTImBNkVxglUT-gHNSw.eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsImNvZGUiOiJBUUQ0UEZZVXE4eDFIa3V6OW9RV3RlVzE4clQ3SmtVRjBzU1VVcXhfV1BENG8tV1BZYjZuTVdDdDJGMmw4TjJUeUxLSzhIYUU1TUc2MkY5cXZOaXRMN3NGdklNZkhySmluYkdjMWs1THAyZnZYa2Zpa1lLVGJ0OWlZeXVvRDNWUDhTblp4czJCeTQ4RTlYY1ZjUmhGWGJsNnFMeG5YcWxxQ0d3b0hRM1ctRWhlLU02ejVITnhhakJtaVFRVk9PanFBVUtMSlk4Y3pLa0RtejFSY3RjTEFRaW16X1lkLUFkUngxUGwzajVNczdWOFdiMW9xeC05QjA0T2xraXktVU9ZalpSRUJsZjhibnZjQXQ2aUZTc1d2QTA3TjVUYnFIekVxQ0JIYjJNRG4tSUJhajl6TEMwQlVpckM0YzJXbC1GVDNhcyIsImlzc3VlZF9hdCI6MTM5ODE4MDg2NCwidXNlcl9pZCI6IjU3NjI1MjI2MiJ9
Host:medistreet.in
Origin:chrome-extension://fdmmgilgnpjigdojojpjoooidkmcomcm
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36

在此之后也没有解决问题的办法.我怀疑Android Webview没有发送Tomcat拒绝的东西.

任何帮助将非常感谢.

Answer 1

我对此做了更多研究并找出了问题.如果您看到Android的标题并查看Origin Header.

Origin: file://

Tomcat CORS过滤器尝试验证Origin头中的URI,并将"file://"视为无效URI并返回403.

     */
    protected static boolean isValidOrigin(String origin) {
       /* // Checks for encoded characters. Helps prevent CRLF injection.
        if (origin.contains("%")) {
            return false;
        }

        URI originURI;

        try {
            originURI = new URI(origin);
        } catch (URISyntaxException e) {
            return false;
        }
        // If scheme for URI is null, return false. Return true otherwise.
        return originURI.getScheme() != null;
*/
        return true;
    }

我需要更多地了解Android发送错误URI的原因.