Request header field x-xsrf-token is not allowed by Access-Control-Allow-Headers in preflight respon

布满荆棘的人生 2022-09-15 05:46 38阅读 0赞

设置下Access-Control-Allow-Headers

@Component
    @WebFilter
    public class CorsFilter implements Filter { 
        private final static String  SPLIT = ";";
    
        @Value("${roc.allow.origins:http://aa.aa.cn:8088}")
        private String allowOrigins ;
        private List<String> allows = null;
    
        @Override
        public void init(FilterConfig filterConfig) throws ServletException { 
            if (allowOrigins.contains(SPLIT)) { 
                allows = Arrays.asList(allowOrigins.split(SPLIT).clone());
            } else { 
                allows.add(allowOrigins);
            }
        }
    
        @Override
        public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { 
            HttpServletResponse response = (HttpServletResponse) res;
            HttpServletRequest request = (HttpServletRequest) req;
            String origin = request.getHeader("Origin");
            if (allows.contains(origin)) { 
                response.setHeader("Access-Control-Allow-Origin",origin);
                response.setHeader("Access-Control-Allow-Methods", "*");
                response.setHeader("Access-Control-Max-Age", "3600");
                response.setHeader("Access-Control-Allow-Headers", "DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,x-xsrf-token,x-csrf-token,If-Modified-Since,Cache-Control,Content-Type, X-Custom-Header, Access-Control-Expose-Headers, Token, Authorization");
                response.setHeader("Access-Control-Allow-Credentials", "true");
                response.setHeader("Access-Control-Max-Age", "3600");
                response.setHeader("Expires", "-1");
                response.setHeader("Cache-Control", "no-cache");
                response.setHeader("pragma", "no-cache");
                if ("OPTIONS".equals(request.getMethod())){ 
                    response.setStatus(HttpStatus.SC_OK);
                    return;
                }
            }
            chain.doFilter(req, res);
        }
    
        @Override
        public void destroy() { 
    
        }
    }

Request header field x-xsrf-token is not allowed by Access-Control-Allow-Headers in preflight respon

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关解决Request header field XXX is not allowed by access-control-allow-headers in preflight response

相关 Request header field xxxx is not allowed by Access-Control-Allow-Headers in preflight response问题

相关 Request header field token is not allowed by Access-Control-Allow-Headers in

相关解决：Request header field token is not allowed by Access-Control-Allow-Headers in

相关 Request header field countent-type is not allowed by Access-Control-Allow-Header in preflight resp

相关 Request header field x-xsrf-token is not allowed by Access-Control-Allow-Headers in preflight respon

相关 axios.post请求出错：Request header field content-type is not allowed by Access-Control-Allow-Headers in……

相关 Request header field * is not allowed by Access-Control-Allow-Headers in preflight response问题解决

相关 jquery的ajax is not allowed Access-Control-Allow-Headers in preflight response 自定义headers

相关解决：Request header field Content-Type is not allowed by Access-Control-Allow-Headers