java cors delete_java-未正确启用Spring Boot Data Rest CORS的OPTIONS / DELETE

我有一个非常简单的例子,我无法上班.

我有为数据库和存储库建模的域.

public interface MyTestRepository extends CrudRepository {

}

我用http://resttesttest.com/进行了测试.对于GET方法,它返回我的JSON REST信息没有任何问题.

但是,当我尝试使用DELETE选项时,就会出现问题.如果我在http://localhost:8080/mytest/1上运行DELETE,我将得到

Response to preflight request doesn’t pass access control check: No

‘Access-Control-Allow-Origin’ header is present on the requested

resource. Origin ‘07003’ is therefore not allowed

access. The response had HTTP status code 403.

我最初尝试了以下方法,但是发现我无法使用它,因为我正在使用Spring-data-Rest. https://jira.spring.io/browse/DATAREST-573

@Override

public void addCorsMappings(CorsRegistry registry) {

registry.addMapping("/**")

.allowedOrigins("*")

.allowedMethods("*")

.allowedHeaders("*")

.allowCredentials(true).maxAge(3600);

}

我四处搜寻,发现了这个.

所以我加了

@Bean

public FilterRegistrationBean corsFilter() {

UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();

CorsConfiguration config = new CorsConfiguration();

config.setAllowCredentials(true);

config.addAllowedOrigin("*");

config.addAllowedHeader("*");

config.addAllowedMethod("*");

source.registerCorsConfiguration("/**", config);

FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));

bean.setOrder(0);

return bean;

}

我也找到了这个线程.

并尝试了以下代码,但没有运气.

@Bean

public FilterRegistrationBean corsFilter() {

UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();

CorsConfiguration config = new CorsConfiguration();

config.setAllowCredentials(true);

config.addAllowedOrigin("*");

config.addAllowedHeader("*");

config.addAllowedMethod("OPTIONS");

config.addAllowedMethod("HEAD");

config.addAllowedMethod("GET");

config.addAllowedMethod("PUT");

config.addAllowedMethod("POST");

config.addAllowedMethod("DELETE");

config.addAllowedMethod("PATCH");

source.registerCorsConfiguration("/**", config);

// return new CorsFilter(source);

final FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));

bean.setOrder(0);

return bean;

}

我添加了一个catch all进行测试,这应该允许所有CORS明智地通过,但是即使我有“ *”,我仍然保持No’Access-Control-Allow-Origin’.

在这一点上,我不知道为什么我的预检请求没有通过访问控制检查.

curl发出删除文件没有问题.

编辑：

最终找到了确切的解决方案.我不确定我所拥有的与这种方法之间的区别,但这似乎可行.

import org.springframework.stereotype.Component;

import javax.servlet.*;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

/**

* Note this is a very simple CORS filter that is wide open.

* This would need to be locked down.

* Source: https://stackoverflow.com/questions/39565438/no-access-control-allow-origin-error-with-spring-restful-hosted-in-pivotal-web

*/

@Component

public class CORSFilter implements Filter {

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

HttpServletResponse response = (HttpServletResponse) res;

response.setHeader("Access-Control-Allow-Origin", "*");

response.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, OPTIONS, DELETE");

response.setHeader("Access-Control-Max-Age", "3600");

response.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");

chain.doFilter(req, res);

}

public void init(FilterConfig filterConfig) {}

public void destroy() {}

}

解决方法:

这是我用作允许所有CORS servlet过滤器的内容：

public class PermissiveCORSFilter implements Filter {

private static final Logger LOGGER = LoggerFactory.getLogger(PermissiveCORSFilter.class);

private static final Pattern PATTERN = Pattern.compile("^[a-zA-Z0-9 ,-_]*$");

@Override

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

HttpServletResponse response = (HttpServletResponse) res;

HttpServletRequest request = (HttpServletRequest) req;

String origin;

String credentialFlag;

if (request.getHeader("Origin") == null) {

origin = "*";

credentialFlag = "false";

} else {

origin = request.getHeader("Origin");

credentialFlag = "true";

}

// need to do origin.toString() to avoid findbugs error about response splitting

response.addHeader("Access-Control-Allow-Origin", origin.toString());

response.setHeader("Access-Control-Allow-Credentials", credentialFlag);

if ("OPTIONS".equals(request.getMethod())) {

LOGGER.info("Received OPTIONS request from origin:" + request.getHeader("Origin"));

response.setHeader("Access-Control-Allow-Methods", "GET,POST,HEAD,OPTIONS,PUT,DELETE");

response.setHeader("Access-Control-Max-Age", "3600");

String headers = StringUtils.trimToEmpty(request.getHeader("Access-Control-Request-Headers"));

if (!PATTERN.matcher(headers).matches()) {

throw new ServletException("Invalid value provided for 'Access-Control-Request-Headers' header");

}

response.setHeader("Access-Control-Allow-Headers", headers); // allow any headers

}

chain.doFilter(req, res);

}

@Override

public void init(FilterConfig filterConfig) {

// Do nothing

}

@Override

public void destroy() {

// Do nothing

}

标签：java,spring,rest,spring-data-rest,spring-mvc

来源： https://codeday.me/bug/20191011/1893415.html