Swagger跨域问题的解决

现象:可以访问以localhost:8080为为域名的Swagger,将localhost换成本机ip地址后出现无权限访问的问题,其实质为跨域问题

解决方法:

第一,在pom.xml中添加maven依赖

<!-- CORS配置,为了让别的机器访问本机的swagger接口文档服务 -->  
       <dependency>  
           <groupId>com.thetransactioncompany</groupId>  
           <artifactId>cors-filter</artifactId>  
        <version>2.5</version> 
 </dependency>   
第二,在web.xml中添加配置

<!-- cors配置 -->  
    <filter>  
        <filter-name>CORS</filter-name>  
        <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>  
        <init-param>  
            <param-name>cors.allowOrigin</param-name>  
            <param-value>*</param-value>  
        </init-param>  
        <init-param>  
            <param-name>cors.supportedMethods</param-name>  
            <param-value>GET, POST, HEAD, PUT, DELETE</param-value>  
        </init-param>  
        <init-param>  
            <param-name>cors.supportedHeaders</param-name>  
            <param-value>Accept, Origin, X-Requested-With, Content-Type, Last-Modified</param-value>  
        </init-param>  
        <init-param>  
            <param-name>cors.exposedHeaders</param-name>  
            <param-value>Set-Cookie</param-value>  
        </init-param>  
        <init-param>  
            <param-name>cors.supportsCredentials</param-name>  
            <param-value>true</param-value>  
        </init-param>  
    </filter>  
    <filter-mapping>  
        <filter-name>CORS</filter-name>  
        <url-pattern>/*</url-pattern>  
    </filter-mapping>  

注意,这里的配置是允许所有的ip访问,这样会相应的出现安全问题,大家请参考这篇文章:http://www.freebuf.com/articles/web/18493.html

  • 1
    点赞
  • 7
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
好的,你的问题是关于.Net6.0的解决方案和Swagger的显示问题。针对这个问题,我可以给你提供一些信息。 在.Net6.0中,可以通过使用Jsonp(JSON with Padding)解决问题。Jsonp是一种利用<script>标签的技术,它通过在客户端动态创建<script>标签,将请求发送到服务器,服务器返回包裹在回调函数中的JSON数据,客户端通过执行回调函数来获取数据。Jsonp的优点是兼容性好,支持所有浏览器,但是它的安全性较差,容易受到XSS攻击。 在.Net6.0中,可以通过修改Startup.cs文件中的Configure方法来实现Jsonp的处理。具体代码如下: ```csharp app.Use(async (context, next) => { if (context.Request.Query.ContainsKey("callback")) { context.Response.Headers.Add("Access-Control-Allow-Origin", "*"); context.Response.Headers.Add("Access-Control-Allow-Methods", "GET,POST"); context.Response.Headers.Add("Access-Control-Allow-Headers", "Content-Type"); context.Response.Headers.Add("Content-Type", "application/javascript"); var callback = context.Request.Query["callback"]; var response = await next.Invoke(); var payload = await response.BodyReader.ReadAsync(); var content = Encoding.UTF8.GetString(payload.Buffer.ToArray()).TrimEnd('\0'); var jsonp = $"{callback}({content})"; var buffer = Encoding.UTF8.GetBytes(jsonp); await context.Response.BodyWriter.WriteAsync(buffer); } else { await next.Invoke(); } }); ``` 针对Swagger的显示问题,可以在Swagger的配置文件中添加相关的配置,具体代码如下: ```csharp services.AddSwaggerGen(c => { c.SwaggerDoc("v1", new OpenApiInfo { Title = "My API", Version = "v1" }); c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme { Description = "JWT Authorization header using the Bearer scheme. Example: \"Bearer {token}\"", Name = "Authorization", In = ParameterLocation.Header, Type = SecuritySchemeType.Http, Scheme = "bearer", BearerFormat = "JWT" }); c.AddSecurityRequirement(new OpenApiSecurityRequirement { { new OpenApiSecurityScheme { Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "Bearer" } }, new string[] {} } }); c.EnableAnnotations(); c.AddFluentValidationRules(); c.OperationFilter<AuthorizeCheckOperationFilter>(); c.OperationFilter<AddHeaderOperationFilter>("Correlation-ID", "Correlation ID for request"); c.OperationFilter<AddResponseHeadersFilter>(); c.OperationFilter<AddSwaggerExamplesHeader>(); c.IncludeXmlComments(XmlCommentsFilePath); c.ResolveConflictingActions(apiDescriptions => apiDescriptions.First()); c.AddCorsPolicies(); }); ``` 在上面的代码中,c.AddCorsPolicies()方法是自定义的Swagger扩展方法,用来添加相关的配置。具体代码如下: ```csharp public static class SwaggerServiceExtensions { public static void AddCorsPolicies(this SwaggerGenOptions options) { options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme { Description = "JWT Authorization header using the Bearer scheme. Example: \"Bearer {token}\"", Name = "Authorization", In = ParameterLocation.Header, Type = SecuritySchemeType.Http, Scheme = "bearer", BearerFormat = "JWT" }); options.AddSecurityRequirement(new OpenApiSecurityRequirement { { new OpenApiSecurityScheme { Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "Bearer" } }, new string[] {} } }); options.OperationFilter<AuthorizeCheckOperationFilter>(); options.OperationFilter<AddHeaderOperationFilter>("Correlation-ID", "Correlation ID for request"); options.OperationFilter<AddResponseHeadersFilter>(); options.OperationFilter<AddSwaggerExamplesHeader>(); options.IncludeXmlComments(XmlCommentsFilePath); options.ResolveConflictingActions(apiDescriptions => apiDescriptions.First()); options.AddCorsPolicies(config => { config.AddPolicy("AllowAll", builder => { builder.AllowAnyOrigin() .AllowAnyMethod() .AllowAnyHeader() .WithExposedHeaders("Content-Disposition"); }); }); } public static void AddCorsPolicies(this SwaggerUIOptions options, Action<CorsOptions> setupAction) { var corsOptions = new CorsOptions(); setupAction(corsOptions); options.IndexStream = () => new CorsIndexHtmlStream(corsOptions); } private class CorsIndexHtmlStream : MemoryStream { private readonly CorsOptions _corsOptions; public CorsIndexHtmlStream(CorsOptions corsOptions) { _corsOptions = corsOptions; var basePath = AppContext.BaseDirectory; using (var fileStream = new FileStream(Path.Combine(basePath, "index.html"), FileMode.Open, FileAccess.Read)) { fileStream.CopyToAsync(this).Wait(); } } public override void Write(byte[] buffer, int offset, int count) { var html = Encoding.UTF8.GetString(buffer, offset, count); var corsPolicy = _corsOptions.GetPolicy("AllowAll"); html = html.Replace("__cors_origin__", corsPolicy.AllowAnyOrigin ? "*" : string.Join(",", corsPolicy.Origins)); html = html.Replace("__cors_methods__", string.Join(",", corsPolicy.Methods)); html = html.Replace("__cors_headers__", string.Join(",", corsPolicy.Headers)); buffer = Encoding.UTF8.GetBytes(html); base.Write(buffer, 0, buffer.Length); } } } ``` 在上述代码中,我们主要是通过调用options.AddCorsPolicies()方法来添加相关的配置。这里的配置是基于CORS(Cross-Origin Resource Sharing)实现的,它可以在服务器端控制哪些名可以访问资源,从而提高安全性。具体的配置可以根据实际需求进行调整。 希望以上信息能够对你有所帮助。如果还有其他问题,请随时提出。
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值