一个运行了很久的项目(暂时无人使用)需要迁移,自己也搞不清什么时候开始页面跨域报错:
Access to XMLHttpRequest at 'http://127.0.0.1:8080/xxx' from origin 'http://127.0.0.1:8081' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
搜索报错信息,尝试了网上多种解决方案未果,因为项目长时间除了偶尔打安全补丁完全没有改动,所以一开始没有想到后端针对跨域有报错信息:
java.lang.IllegalArgumentException: When allowCredentials is true, allowedOrigins cannot contain the special value "*" since that cannot be set on the "Access-Control-Allow-Origin" response header. To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead.
针对后端报错再进行搜索,找到了问题所在,参见:
所以是安全补丁升级的时候,SpringBoot从2.2.13升到了2.5.15,导致跨域报错
<!-- SpringBoot的依赖配置-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-dependencies</artifactId>
<version>2.5.15</version>
<type>pom</type>
<scope>import</scope>
</dependency>
找到CorsFilter设置的代码,按照报错提示,将 config.addAllowedOrigin("*"); 修改为config.addAllowedOriginPattern("*"); 问题解决
/**
* 跨域配置
*/
@Bean
public CorsFilter corsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
// 设置访问源地址
config.addAllowedOriginPattern("*");
// 设置访问源请求头
config.addAllowedHeader("*");
// 设置访问源请求方法
config.addAllowedMethod("*");
// 对接口配置跨域设置
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);
}