Zuul+Spring Security OAuth2 中 CORS 跨域问题

1、ajax 同源策略 相关文章 跨域资源共享 CORS 详解

2、Access-Control-Allow-Credentials设置为ture时 Access-Control-Allow-Origin 不能 设置成 *

header("Access-Control-Allow-Credentials: true");

header("Access-Control-Allow-Origin: http://www.xxx.com");

解决方法：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;

/**
 * @author Administrator
 * @Title: du_yy
 * @Description: 跨域
 * @date 2018/4/30  14:08
 */
@Configuration
public class GlobalCorsConfiguration {
    @Bean
    public CorsFilter corsFilter() {
        CorsConfiguration corsConfiguration = new CorsConfiguration();
        corsConfiguration.setAllowCredentials(true);
        corsConfiguration.addAllowedOrigin("*");
        corsConfiguration.addAllowedHeader("*");
        corsConfiguration.addAllowedMethod("*");
//        corsConfiguration.addExposedHeader("head1");
        //corsConfiguration.addExposedHeader("Location");
        UrlBasedCorsConfigurationSource urlBasedCorsConfigurationSource = new UrlBasedCorsConfigurationSource();
        urlBasedCorsConfigurationSource.registerCorsConfiguration("/**", corsConfiguration);
        return new CorsFilter(urlBasedCorsConfigurationSource);
    }
}

 

关闭SecurityConfig 中的http.cors().and().csrf().disable() 即可，其他地方不用写跨域处理，不要相信ZuulFilter的有效性（之前一直用和这个，后来发现这个是有效，只是级别不如javax.servlet.Filter）；

 

相关文章

跨域资源共享 CORS 详解

Vue.js post请求cookies小问题

ajax跨域请求及传递cookie

转载于:https://my.oschina.net/u/3422521/blog/3044397