jdk1.7，spring 4.2，解决跨域问题

在开发中，遇到跨域问题，按照网上的很多blog操作，总是出现错误，于是总结下来，供大家参考，由于spring-cors支持1.8，所以我用的是过滤器方式

1、在网上copy一种案例，到我项目，如下web.xml和自定义filter

<filter>
		<filter-name>cors</filter-name>
		<filter-class>****.CORSFilter</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>cors</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class CORSFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.addHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
        chain.doFilter(req, res);
    }

    @Override
    public void destroy() {

    }
}

（2）报错

The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin '*****.com' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

解决办法：把“*” 替换成自己项目的访问ip或者域名，这里我们项目是（http://localwww.chuangkit.com）

所以：

 response.setHeader("Access-Control-Allow-Origin", "http://localwww.chuangkit.com");

（3）这样以后，报错

 The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. Origin '*com' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

解决办法：加返回值

response.setHeader("Access-Control-Allow-Credentials","true");

就可以正常访问