应项目要求app端接口用Token,后台接口用Session造成的一系列跨域问题解决
1.web端开启cookie跨域分享后,SessionID每次请求都是变化的
解决方案:
Access-Control-Allow-Origin 跨域参数不能设置成通配符* 得根据实际取具体的内容
2.app端需要自定义header的token字段需要在
Access-Control-Allow-Headers 最后面补齐自己定义的token参数 如我的accessToken
此处给出我的代码
package com.thirtydays.common.interceptor;
import java.io.IOException;
import java.util.Arrays;
import java.util.Enumeration;
import java.util.List;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
/**
* Cross-Origin Resource Sharing跨源资源共享 过滤器 允许前台页面通过ajax或者angualr直接访问
*
*/
@Component
@Slf4j
public class CorsFilter implements Filter {
private static final Logger LOGGER = LoggerFactory.getLogger(CorsFilter.class);
public static final String HOST_SPLIT_LINE = ",";
public static final String ALLOW_HEADER_SPLIT_LINE = "\\|";
@Value("${page.home}")
private String pageHome;
@Override
public void init(FilterConfig filterConfig)
throws ServletException {
}
@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
HttpServletResponse response = (HttpServletResponse)res;
HttpServletRequest request = (HttpServletRequest)req;
List domains = Arrays.asList(pageHome.split(HOST_SPLIT_LINE));
// 获取发起当前请求的域名
String originHead = request.getHeader("Origin");
int index = index(domains, originHead);
if (index >= 0) {
String matchHeader = domains.get(index);
if (matchHeader.split(ALLOW_HEADER_SPLIT_LINE).length > 1) {
String [] headerConfig = matchHeader.split(ALLOW_HEADER_SPLIT_LINE);
// 允许的访问域,允许全部则为*,允许部分则配置详细的http地址,端口后不能有/
response.setHeader("Access-Control-Allow-Origin", headerConfig[1]);
} else {
response.setHeader("Access-Control-Allow-Origin", originHead);
}
} else {
response.setHeader("Access-Control-Allow-Origin", domains.get(0));
}
// 允许的访问域,允许全部则为*,允许部分则配置详细的http地址,端口后不能有/
// response.setHeader("Access-Control-Allow-Origin", "*");
// 访问授权有效期 为一周,单位为秒
response.setHeader("Access-Control-Max-Age", "604800");
// 默认只允许GET、POST请求,需要将PUT和DELETE也加入此列
response.setHeader("Access-Control-Allow-Methods", "OPTIONS,GET,POST,PUT,DELETE");
// 允许自定义 header accessToken
response.setHeader("Access-Control-Allow-Headers",
"Authorization,Origin, Accept, Content-Type, X-HTTP-Method, X-HTTP-METHOD-OVERRIDE,XRequestedWith,X-Requested-With,xhr,custom-enterpriseId,x-clientappversion, x-wxopenid, x-devicetype,accessToken");
response.setHeader("Access-Control-Allow-Credentials", "true");
chain.doFilter(req, res);
}
@Override
public void destroy() {
}
/**
* 计算Header所在索引位置
* @param domains 域名列表
* @param curDomain 当前页面域名
* @return
* @return int 返回类型
* @date 2020年6月30日 上午11:53:31
*/
private int index(List domains, String curDomain) {
String domain = null;
for (int i = 0; i < domains.size(); i++) {
domain = domains.get(i);
String strs [] = domain.split(ALLOW_HEADER_SPLIT_LINE);
if ((null != strs) && (strs[0].equals(curDomain))) {
return i;
}
if (domain.equals(curDomain)) {
return i;
}
}
return -1;
}
}