第Security框架:如何使用CorsFilter解決前端跨域請求問題if(request.getMethod().equals(OPTIONS))

//response.setStatus(HttpServletResponse.SC_OK);

response.setStatus(HttpServletResponse.SC_NO_CONTENT);

else

filterChain.doFilter(request,response);

//@Override

//publicvoiddoFilter(ServletRequestreq,ServletResponseres,

//FilterChainchain)throwsIOException,ServletException{

//HttpServletResponseresponse=(HttpServletResponse)res;

////測試環境用【*】匹配，上生產環境后需要切換為實際的前端請求地址

//response.setHeader(Access-Control-Allow-Origin,*

//response.setHeader(Access-Control-Allow-Methods,POST,GET,OPTIONS,DELETE

//response.setHeader(Access-Control-Max-Age,0

//response.setHeader(Access-Control-Allow-Headers,Origin,No-Cache,X-Requested-With,If-Modified-Since,Pragma,Last-Modified,Cache-Control,Expires,Content-Type,X-E4M-With,auth

//response.setHeader(Access-Control-Allow-Credentials,true

//response.setHeader(XDomainRequestAllowed,1

//chain.doFilter(req,res);

//@Override

//publicvoiddestroy(){

//@Override

//publicvoidinit(FilterConfigarg0)throwsServletException{

}

注釋：這里的Access-Control-Expose-Headers的請求頭是為了使前端能夠獲得到后端在response中自定義的header，不設置的話，前端只能看到幾個默認顯示的header。我這里是在使用response導出Excel的時候將文件名和下載狀態信息以自定義請求頭的形式放在了response的header里。

在Security的配置文件中初始化CorsFilter的Bean

@Bean

publicCorsFiltercorsFilter()throwsException{

returnnewCorsFilter();

在Security的配置文件中添加Filter配置，和映射配置

.antMatchers(HttpMethod.OPTIONS,/**).permitAll()

//除上面外的所有請求全部需要鑒權認證。.and()相當于標示一個標簽的結束，之前相當于都是一個標簽項下的內容

.anyRequest().authenticated().and()

.addFilterBefore(corsFilter(),UsernamePasswordAuthenticationFilter.class)

附：該配置文件

packagecom.handlecar.basf_pmdb_service.conf;

importcom.handlecar.basf_pmdb_service.filter.CorsFilter;

importcom.handlecar.basf_pmdb_service.filter.JwtAuthenticationTokenFilter;

importcom.handlecar.basf_pmdb_service.security.JwtTokenUtil;

importcom.handlecar.basf_pmdb_service.security.CustomAuthenticationProvider;

importorg.springframework.beans.factory.annotation.Autowired;

importorg.springframework.context.annotation.Bean;

importorg.springframework.context.annotation.Configuration;

importorg.springframework.http.HttpMethod;

importorg.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

importorg.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

importorg.springframework.security.config.annotation.web.builders.HttpSecurity;

importorg.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

importorg.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

importorg.springframework.security.config.http.SessionCreationPolicy;

importorg.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

//importcom.allcom.security.JwtTokenUtil;

@Configuration

//@EnableWebSecurityisusedtoenableSpringSecurityswebsecuritysupportandprovidetheSpr