1、ajax 同源策略 相关文章 跨域资源共享 CORS 详解
2、Access-Control-Allow-Credentials设置为ture时 Access-Control-Allow-Origin 不能 设置成 *
header("Access-Control-Allow-Credentials: true");
header("Access-Control-Allow-Origin: http://www.xxx.com");
解决方法:
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;
/**
* @author Administrator
* @Title: du_yy
* @Description: 跨域
* @date 2018/4/30 14:08
*/
@Configuration
public class GlobalCorsConfiguration {
@Bean
public CorsFilter corsFilter() {
CorsConfiguration corsConfiguration = new CorsConfiguration();
corsConfiguration.setAllowCredentials(true);
corsConfiguration.addAllowedOrigin("*");
corsConfiguration.addAllowedHeader("*");
corsConfiguration.addAllowedMethod("*");
// corsConfiguration.addExposedHeader("head1");
//corsConfiguration.addExposedHeader("Location");
UrlBasedCorsConfigurationSource urlBasedCorsConfigurationSource = new UrlBasedCorsConfigurationSource();
urlBasedCorsConfigurationSource.registerCorsConfiguration("/**", corsConfiguration);
return new CorsFilter(urlBasedCorsConfigurationSource);
}
}
关闭SecurityConfig 中的http.cors().and().csrf().disable() 即可,其他地方不用写跨域处理,不要相信ZuulFilter的有效性(之前一直用和这个,后来发现这个是有效,只是级别不如javax.servlet.Filter);
相关文章