springboot：跨域支持Cors

上帝说_要有光

已于 2022-08-07 11:50:57 修改

阅读量179

点赞数

分类专栏： springboot浅学文章标签： spring boot java restful

于 2022-08-07 11:49:25 首次发布

本文链接：https://blog.csdn.net/Gu31415/article/details/126208542

版权

springboot浅学专栏收录该内容

6 篇文章 0 订阅

订阅专栏

方法一：实现WebMvcConfigurer，重写addCorsMappings方法

这种方式是全局设置

@ConditionalOnClass(WebMvcConfigurer.class)
@Configuration
@ConditionalOnWebApplication
@ServletComponentScan
@Slf4j
public class WebAutoConfiguration implements WebMvcConfigurer {
	
	@Override
	public void addCorsMappings(CorsRegistry registry) {
		registry.addMapping("/**")
				.allowedHeaders("*")
				//是否发送Cookie信息
				.allowCredentials(true)
				.allowedMethods("POST","GET","PUT","DELETE","OPTIONS")
				//暴露哪些头部信息（因为跨域访问默认不能获取全部头部信息）
//				.exposedHeaders("*")
				.allowedOrigins("*");

	}
}

方法二：在Controller中添加@CrossOrigin注解

该方式，只支持springframework4.2以后

加在类上，则该类所有Controller接口都支持

加在方法上，只支持该方法

注解详情

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by Fernflower decompiler)
//

package org.springframework.web.bind.annotation;

import java.lang.annotation.Documented;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
import org.springframework.core.annotation.AliasFor;

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface CrossOrigin {
    /** @deprecated */
    @Deprecated
    String[] DEFAULT_ORIGINS = new String[]{"*"};
    /** @deprecated */
    @Deprecated
    String[] DEFAULT_ALLOWED_HEADERS = new String[]{"*"};
    /** @deprecated */
    @Deprecated
    boolean DEFAULT_ALLOW_CREDENTIALS = true;
    /** @deprecated */
    @Deprecated
    long DEFAULT_MAX_AGE = 1800L;

    @AliasFor("origins")
    String[] value() default {};

    @AliasFor("value")
    String[] origins() default {};

    String[] allowedHeaders() default {};

    String[] exposedHeaders() default {};

    RequestMethod[] methods() default {};

    String allowCredentials() default "";

    long maxAge() default -1L;
}

origins：允许可访问的域列表

maxAge:准备响应前的缓存持续的最大时间（以秒为单位）

@Controller
@CrossOrigin(origins = "http://www.sina.com", maxAge = 3600)
public class HelloController {
    @ResponseBody
    @RequestMapping("/hello")
    public String hello() {
        return "Hello World";
    }
}

方法三，spring提供了CorsFilter对Cors的支持

使用方式如下

import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;

@Configuration
public class CorsFilterConfig {
    @Bean
    public FilterRegistrationBean corsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowCredentials(true);
        config.addAllowedOrigin("http://domain1.com");
        config.addAllowedHeader("*");
        config.addAllowedMethod("*");
        source.registerCorsConfiguration("/**", config);
        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
        bean.setOrder(0);
        return bean;
    }
}