我需要在java中做一个cors过滤器,我想允许任何来源、 header 和方法,我创建了以下过滤器:
@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class CorsFilter implements Filter {
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse resp = (HttpServletResponse) response;
resp.setHeader("Access-Control-Allow-Origin", req.getHeader("Origin"));
resp.setHeader("Access-Control-Allow-Credentials", "true");
if("OPTIONS".equals(req.getMethod())) {
resp.setHeader("Access-Control-Allow-Methods", req.getHeader("Access-Control-Request-Method"));
resp.setHeader("Access-Control-Allow-Headers", req.getHeader("Access-Control-Request-Headers"));
resp.setHeader("Access-Control-Max-Age", "3600");
resp.setStatus(HttpServletResponse.SC_OK);
} else {
chain.doFilter(request, response);
}
}
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void destroy() {
}
}
我使用 *
允许任何来源、 header 和方法,但我需要从浏览器发送 Cookie,并且当来源 header 为 *
时,浏览器在控制台中显示以下消息
The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
因此,我使用请求中的 "Origin"
header 作为 "Access-Control-Allow-Origin";
如果我同时收到来自多个来源的请求,此方法是否有效?
最佳答案
是的,假设请求中有 Origin
header ,这将起作用。对于更全面的处理方式,我建议你看看 Spring 的 CorsConfiguration.java :
@Nullable
public String checkOrigin(@Nullable String requestOrigin) {
if (!StringUtils.hasText(requestOrigin)) {
return null;
}
if (ObjectUtils.isEmpty(this.allowedOrigins)) {
return null;
}
if (this.allowedOrigins.contains(ALL)) {
if (this.allowCredentials != Boolean.TRUE) {
return ALL;
}
else {
return requestOrigin;
}
}
for (String allowedOrigin : this.allowedOrigins) {
if (requestOrigin.equalsIgnoreCase(allowedOrigin)) {
return requestOrigin;
}
}
return null;
}
关于java - 这是在 Java 中创建允许任何来源的 CORS 过滤器的好方法吗?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/59110543/