spring 跨域CORS Filter

末蓝、 2022-03-25 01:47 274阅读 0赞

方案一  
spring中可以采用的跨域配置方式如下：

RequestMapping  
在一般性的配置中，在controller前添加@CrossOrigin即可使用spring的默认配置，允许跨域  
该注解也可以配置一些设定，适合针对个别的controller

@CrossOrigin

方案二  
webconfig的方式配置全局跨域

@Configuration
    public class JxWebMvcConfiguration extends WebMvcConfigurerAdapter {
    
      /**
      * Cross Origin Resource Support(CORS) for the Spring MVC.
      * automatically.
      * https://my.oschina.net/wangnian/blog/689020
      * http://spring.io/guides/gs/rest-service-cors/
      */
      /* @Override
      public void addCorsMappings(CorsRegistry registry) {
      registry.addMapping("*")
      .allowedOrigins("*").exposedHeaders("x-total-count","x-auth-token")
      .allowedMethods("GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "TRACE");
      }*/
    }

这种方式的缺陷是，filter的顺序是固定的，在引入第三方组件的时候可能会因为filter滞后，导致出错  
方案三  
定制Filter

@Bean
    public FilterRegistrationBean corsFilter() {
      UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
      CorsConfiguration config = new CorsConfiguration();
      config.setAllowCredentials(true);
      config.addAllowedOrigin("*");
      config.addAllowedHeader("*");
      config.addAllowedMethod("*");
      source.registerCorsConfiguration("/**", config);
      FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
      bean.setOrder(0);
      return bean;
    }

方案3缺陷  
在3中，使用zuul的时候，的确解决了跨域问题，但是spring security的filter还是在其前边，引起登录的时候不能正常捕获401错误

@Bean
        public Filter corsFilter() {
            UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
            CorsConfiguration config = new CorsConfiguration();
            config.setAllowCredentials(true);
            config.addAllowedOrigin("*");
            config.addAllowedHeader("*");
            config.addAllowedMethod("*");
            config.addExposedHeader("x-auth-token");
            config.addExposedHeader("x-total-count");
            source.registerCorsConfiguration("/**", config);
            return new CorsFilter(source);
        }
    
        @Override
        protected void configure(HttpSecurity httpSecurity) throws Exception {       
            httpSecurity.addFilterBefore(corsFilter(), ChannelProcessingFilter.class);
          }

# spring security 标准Filter及其在filter chain的顺序 #

<table> 
 <tbody> 
  <tr> 
   <td>Alias</td> 
   <td>Filter Class</td> 
   <td>Namespace Element or Attribute</td> 
  </tr> 
  <tr> 
   <td>CHANNEL_FILTER</td> 
   <td>ChannelProcessingFilter</td> 
   <td>http/intercept-url@requires-channel</td> 
  </tr> 
  <tr> 
   <td>SECURITY_CONTEXT_FILTER</td> 
   <td>SecurityContextPersistenceFilter</td> 
   <td>http</td> 
  </tr> 
  <tr> 
   <td>CONCURRENT_SESSION_FILTER</td> 
   <td>ConcurrentSessionFilter</td> 
   <td>session-management/concurrency-control</td> 
  </tr> 
  <tr> 
   <td>HEADERS_FILTER</td> 
   <td>HeaderWriterFilter</td> 
   <td>http/headers</td> 
  </tr> 
  <tr> 
   <td>CSRF_FILTER</td> 
   <td>CsrfFilter</td> 
   <td>http/csrf</td> 
  </tr> 
  <tr> 
   <td>LOGOUT_FILTER</td> 
   <td>LogoutFilter</td> 
   <td>http/logout</td> 
  </tr> 
  <tr> 
   <td>X509_FILTER</td> 
   <td>X509AuthenticationFilter</td> 
   <td>http/x509</td> 
  </tr> 
  <tr> 
   <td>PRE_AUTH_FILTER</td> 
   <td>AstractPreAuthenticatedProcessingFilter&nbsp;&nbsp;Subclasses</td> 
   <td>N/A</td> 
  </tr> 
  <tr> 
   <td>CAS_FILTER</td> 
   <td>CasAuthenticationFilter</td> 
   <td>N/A</td> 
  </tr> 
  <tr> 
   <td>FORM_LOGIN_FILTER</td> 
   <td>UsernamePasswordAuthenticationFilter</td> 
   <td>http/form-login</td> 
  </tr> 
  <tr> 
   <td>BASIC_AUTH_FILTER</td> 
   <td>BasicAuthenticationFilter</td> 
   <td>http/http-basic</td> 
  </tr> 
  <tr> 
   <td>SERVLET_API_SUPPORT_FILTER</td> 
   <td>SecurityContextHolderAwareRequestFilter</td> 
   <td>http/@servlet-api-provision</td> 
  </tr> 
  <tr> 
   <td>JAAS_API_SUPPORT_FILTER</td> 
   <td>JaasApiIntegrationFilter</td> 
   <td>http/@jaas-api-provision</td> 
  </tr> 
  <tr> 
   <td>REMEMBER_ME_FILTER</td> 
   <td>RememberMeAuthenticationFilter</td> 
   <td>http/remember-me</td> 
  </tr> 
  <tr> 
   <td>ANONYMOUS_FILTER</td> 
   <td>AnonymousAuthenticationFilter</td> 
   <td>http/anonymous</td> 
  </tr> 
  <tr> 
   <td>SESSION_MANAGEMENT_FILTER</td> 
   <td>SessionManagementFilter</td> 
   <td>session-management</td> 
  </tr> 
  <tr> 
   <td>EXCEPTION_TRANSLATION_FILTER</td> 
   <td>ExceptionTranslationFilter</td> 
   <td>http</td> 
  </tr> 
  <tr> 
   <td>FILTER_SECURITY_INTERCEPTOR</td> 
   <td>FilterSecurityInterceptor</td> 
   <td>http</td> 
  </tr> 
  <tr> 
   <td>SWITCH_USER_FILTER</td> 
   <td>SwitchUserFilter</td> 
   <td>N/A</td> 
  </tr> 
 </tbody> 
</table>

参考（4.3.6）

[http://docs.spring.io/spring-security/site/docs/3.2.8.RELEASE/reference/htmlsingle/\#ns-web-advanced][http_docs.spring.io_spring-security_site_docs_3.2.8.RELEASE_reference_htmlsingle_ns-web-advanced]

[http_docs.spring.io_spring-security_site_docs_3.2.8.RELEASE_reference_htmlsingle_ns-web-advanced]: http://docs.spring.io/spring-security/site/docs/3.2.8.RELEASE/reference/htmlsingle/#ns-web-advanced