Spring Security CORS过滤器无法正常工作

Question

我正在使用带有OAuth2(版本:4.0.4.RELEASE)和spring(版本:4.3.1.RELEASE)的spring security.

我正在开发Angular的前端,我正在使用grunt connect:dev(http://127.0.0.1:9000).当我尝试通过localhost地址登录时,一切正常,但是从其他地方我收到错误:

"XMLHttpRequest无法加载http:// localhost:8084/oauth/token？client_id = MY_CLIENT_ID.对预检请求的响应未通过访问控制检查:请求的资源上没有"Access-Control-Allow-Origin"标头.因此,不允许来源" http://127.0.0.1:9000 "访问.响应的HTTP状态代码为401."

我在WebMvcConfigurerAdapter(如下所示)中配置了映射(Overrided public void addCorsMappings(CorsRegistry registry)),但它仍然不适用于http://127.0.0.1:9000.

    registry.addMapping("/**")
            .allowedOrigins("http://127.0.0.1:9000")
            .allowedMethods("POST", "OPTIONS", "GET", "DELETE", "PUT")
            .allowedHeaders("X-Requested-With,Origin,Content-Type,Accept,Authorization")
            .allowCredentials(true).maxAge(3600);

配置基于:https://spring.io/guides/gs/rest-service-cors/

请指出正确的解决方案来解决这个问题.

Answer 1

希望你很久以前找到答案,但如果没有(如果有其他人发现这个问题像我一样):

问题是Spring Security使用过滤器,这些过滤器通常优先于用户定义的过滤器@CrossOrigin和类似的注释等.

对我来说有用的是将CORS过滤器定义为具有最高优先级的bean,如此处所示.

@Configuration
public class MyConfiguration {

    @Bean
    public FilterRegistrationBean corsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowCredentials(true);
        config.addAllowedOrigin("http://127.0.0.1:9000");
        config.setAllowedMethods(Arrays.asList("POST", "OPTIONS", "GET", "DELETE", "PUT"));
        config.setAllowedHeaders(Arrays.asList("X-Requested-With", "Origin", "Content-Type", "Accept", "Authorization"));
        source.registerCorsConfiguration("/**", config);
        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
        bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
        return bean;
    }
}

Answer 2

你可以尝试类似的事情

@Configuration
public class CorsConfig {
   @Bean
   public WebMvcConfigurer corsConfigurer() {
        return new WebMvcConfigurerAdapter() {
          @Override
          public void addCorsMappings(CorsRegistry registry) {
            registry.addMapping("/**")
                    .allowedMethods(HttpMethod.OPTIONS.name(),
                            HttpMethod.PATCH.name(),
                            HttpMethod.PUT.name(),
                            HttpMethod.DELETE.name(),
                            HttpMethod.GET.name(),
                            HttpMethod.POST.name())
                    .maxAge(360);
            }
       };
   }
}

注意：Spring版本应为4.2或更高版本