Spring-Boot-Jersey设置CORS

Question

我从两个不同的服务器为我的前端和后端提供服务.现在我试图让CORS在Spring-Boot-Jersey后端工作.我尝试了在互联网上找到的所有东西,但似乎没有任何工作,或者我错过了一些东西.

我目前的设置使用了ContainerResponseFilter.我尝试@Provider在Jersey配置中自动注册并手动注册.

ContainerResponseFilter

@Provider
public class CORSFilter implements ContainerResponseFilter {

    @Override
    public void filter(ContainerRequestContext request,
                       ContainerResponseContext response) throws IOException {
        response.getHeaders().add("Access-Control-Allow-Origin", "*");
        response.getHeaders().add("Access-Control-Allow-Headers",
                "origin, content-type, accept, authorization");
        response.getHeaders().add("Access-Control-Allow-Credentials", "true");
        response.getHeaders().add("Access-Control-Allow-Methods",
                "GET, POST, PUT, DELETE, OPTIONS, HEAD");
    }
}

也许它很重要,但我也Spring-Security-oauth2通过添加@EnableOAuth2Sso注释使用.如果您需要更多我的设置,请告诉我.

Answer 1

我用这种方式修复它,首先创建一个类

public class CORSResponseFilter implements   ContainerResponseFilter {
   public void filter(ContainerRequestContext  requestContext,ContainerResponseContext responseContext)
            throws IOException {

        MultivaluedMap<String, Object> headers = responseContext.getHeaders();

        headers.add("Access-Control-Allow-Origin", "*");
        //headers.add("Access-Control-Allow-Origin", "http://abcd.org"); //allows CORS requests only coming from abcd.org
        headers.add("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
        headers.add("Access-Control-Allow-Headers", "X-Requested-With, Content-Type, X-Codingpedia");
    }
}

过滤器必须从ContainerResponseFilter接口继承,并且必须注册为提供者:

public class JerseyConfig extends ResourceConfig {
    public JerseyConfig() {

        register(CORSResponseFilter.class);
        //other registrations

    }

}

Answer 2

通过使用https://spring.io/blog/2015/01/20/the-resource-server-angular-js-and-spring-security-part-iii中显示的 CORSFilter 修复了该问题

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
class CorsFilter implements Filter {

  void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) {
    HttpServletResponse response = (HttpServletResponse) res;
    response.setHeader("Access-Control-Allow-Origin", "*");
    response.setHeader("Access-Control-Allow-Methods", "POST, PUT, GET, OPTIONS, DELETE");
    response.setHeader("Access-Control-Allow-Headers", "x-requested-with");
    response.setHeader("Access-Control-Max-Age", "3600");
    if (request.getMethod()!='OPTIONS') {
      chain.doFilter(req, res);
    } else {
    }
  }

  void init(FilterConfig filterConfig) {}

  void destroy() {}

}