Security框架:如何使用CorsFilter解决前端跨域请求问
目录
- 项目情况
- CORS介绍
- 解决方案
项目情况
最近做的pmdb项目是前后端分离的， 由于测试的时候是前端与后端联调，所以出现了跨域请求的问题。
浏览器默认会向后端发送一个Options方式的请求，根据后端的响应来判断后端支持哪些请求方式，支持才会真正的发送请求。
CORS介绍
CORS（Cross-Origin Resource Sharing 跨源资源共享），当一个请求url的协议、域名、端口三者之间任意一与当前页面地址不同即为跨域。
在日常的项目开发时会不可避免的需要进行跨域操作，而在实际进行跨域请求时，经常会遇到类似 No 'Access-Control-Allow-Origin' header is present on the requested resource.这样的报错。
这样的错误，一般是由于CORS跨域验证机制设置不正确导致的。
解决方案
注释：本项目使用的是SprintBoot+Security+JWT+Swagger
第一步
新建CorsFilter，在过滤器中设置相关请求头
package com.handlecar.basf_pmdb_service.filter;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
public class CorsFilter extends OncePerRequestFilter {
//public class CorsFilter implements Filter {
// static final String ORIGIN = "Origin";
protected void doFilterInternal(
HttpServletRequest request, HttpServletResponse response,
FilterChain filterChain) throws ServletException, IOException {
// String origin = request.getHeader(ORIGIN);
response.setHeader("Access-Control-Allow-Origin", "*");//* or origin as u prefer
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setHeader("Access-Control-Allow-Methods", "PUT, POST, GET, OPTIONS, DELETE");
response.setHeader("Access-Control-Max-Age", "3600");
// response.setHeader("Access-Control-Allow-Headers", "content-type, authorization");
response.setHeader("Access-Control-Allow-Headers", "Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With, Authorization");
response.setHeader("XDomainRequestAllowed","1");
//使前端能够获取到
response.setHeader("Access-Control-Expose-Headers","download-status,download-filename,download-message");
if (request.getMethod().equals("OPTIONS"))
// response.setStatus(HttpServletResponse.SC_OK);
response.setStatus(HttpServletResponse.SC_NO_CONTENT);
else
filterChain.doFilter(request, response);
}
// @Override
// public void doFilter(ServletRequest req, ServletResponse res,
// FilterChain chain) throws IOException, ServletException {
//
// HttpServletResponse response = (HttpServletResponse) res;
// //测试环境用【*】匹配，上生产环境后需要切换为实际的前端请求地址
// response.setHeader("Access-Control-Allow-Origin", "*");
// response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
//
// response.setHeader("Access-Control-Max-Age", "0");
//
// response.setHeader("Access-Control-Allow-Headers", "Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With, auth");
//
// response.setHeader("Access-Control-Allow-Credentials", "true");
//
// response.setHeader("XDomainRequestAllowed","1");
// chain.doFilter(req, res);
// }
//
// @Override
// public void destroy() {
// }
//
// @Override
// public void init(FilterConfig arg0) throws ServletException {
// }
}
注释：这里的Access-Control-Expose-Headers的请求头是为了使前端能够获得到后端在response中自定义的header，不设置的话，前端只能看到几个默认显示的header。我这里是在使用response导出Excel的时候将文件名和下载状态信息以自定义请求头的形式放在了response的header里。
第二步
在Security的配置文件中初始化CorsFilter的Bean
@Bean
public CorsFilter corsFilter() throws Exception {
return new CorsFilter();
}
第三步
在Security的配置文件中添加Filter配置，和映射配置
.antMatchers(HttpMethod.OPTIONS,"/**").permitAll()
// 除上面外的所有请求全部需要鉴权认证。 .and() 相当于标示一个标签的结束，之前相当于都是一个标签项下的内容
.anyRequest().authenticated().and()
.addFilterBefore(corsFilter(), UsernamePasswordAuthenticationFilter.class)
附：该配置文件
package com.handlecar.basf_pmdb_service.conf;
import com.handlecar.basf_pmdb_service.filter.CorsFilter;
import com.handlecar.basf_pmdb_service.filter.JwtAuthenticationTokenFilter;
import com.handlecar.basf_pmdb_service.security.JwtTokenUtil;
import com.handlecar.basf_pmdb_service.security.CustomAuthenticationProvider;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
//import com.allcom.security.JwtTokenUtil;
@Configuration
//@EnableWebSecurity is used to enable Spring Security's web security support and provide the Spring MVC integration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private final CustomAuthenticationProvider customAuthenticationProvider;
@Autowired
public WebSecurityConfig(CustomAuthenticationProvider customAuthenticationProvider) {
this.customAuthenticationProvider = customAuthenticationProvider;
}
@Override
protected void configure(AuthenticationManagerBuilder auth) {
auth.authenticationProvider(customAuthenticationProvider);
}
@Bean
public JwtTokenUtil jwtTokenUtil(){
return new JwtTokenUtil();
}
@Bean
public CorsFilter corsFilter() throws Exception {
return new CorsFilter();
}
@Bean
public JwtAuthenticationTokenFilter authenticationTokenFilterBean() {
return new JwtAuthenticationTokenFilter();
}
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
// 由于使用的是JWT，我们这里不需要csrf,不用担心csrf攻击
.csrf().disable()
// 基于token，所以不需要session
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
.authorizeRequests()
//.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
// 允许对于网站静态资源的无授权访问
.antMatchers(
HttpMethod.GET,
"/",
"/*.html",
"/favicon.ico",
"/**/*.html",
"/**/*.css",
"/**/*.js",
"/webjars/springfox-swagger-ui/images/**","/swagger-resources/configuration/*","/swagger-resources",//swagger请求
"/v2/api-docs"
).permitAll()
// 对于获取token的rest api要允许匿名访问
.antMatchers("/pmdbservice/auth/**","/pmdbservice/keywords/export3").permitAll()
.antMatchers(HttpMethod.OPTIONS,"/**").permitAll()
// 除上面外的所有请求全部需要鉴权认证。 .and() 相当于标示一个标签的结束，之前相当于都是一个标签项下的内容
.anyRequest().authenticated().and()
.addFilterBefore(corsFilter(), UsernamePasswordAuthenticationFilter.class)
.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
// 禁用缓存
httpSecurity.headers().cacheControl();
}
}
以上为个人经验，希望能给大家一个参考，也希望大家多多支持自由互联。
【文章出处http://www.nextecloud.cn/kt.html欢迎转载】