“http://localhost:4200”已被 CORS 策略阻止：请求的资源上不存在“Access-Control-Allow-Origin”标头答案

【问题标题】：'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource“http://localhost:4200”已被 CORS 策略阻止：请求的资源上不存在“Access-Control-Allow-Origin”标头
【发布时间】：2020-11-26 08:52:09
【问题描述】：

我使用 Angular 客户端和 Java 作为后端服务，面临以下问题。我浏览了所有可用的在线资源，但没有任何帮助将不胜感激。 “从源 'http://localhost:4200' 访问 'http://localhost:8081/demo/customer' 的 XMLHttpRequest 已被 CORS 策略阻止：没有 'Access-Control-Allow-Origin' 标头存在于请求的资源上。

控制器代码：

@CrossOrigin(origins = "http://localhost:4200")
@RestController
@RequestMapping("/demo")
public class CustomerController {
    
    @Autowired
    private CustomerService customerService;
    
    @CrossOrigin(origins = "http://localhost:4200")
    @GetMapping("/customer")
    public List<Customer> getCustomerList() {
        
        return customerService.get();
        
    }
    
}

配置代码：

@Configuration
public class CorsConfig {
    @Bean
    public CORSFilter corsFilter() {
        CorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.addAllowedOrigin("http://localhost:4200");
        config.addAllowedMethod(HttpMethod.DELETE);
        config.addAllowedMethod(HttpMethod.GET);
        config.addAllowedMethod(HttpMethod.OPTIONS);
        config.addAllowedMethod(HttpMethod.PUT);
        config.addAllowedMethod(HttpMethod.POST);
        ((UrlBasedCorsConfigurationSource) source).registerCorsConfiguration("/**", config);
        return new CORSFilter(source);
    }
}

【问题讨论】：

在 Spring 中启用 CORS 时，所有端点访问错误默认情况下在客户端显示为 CORS 错误，因为发生错误时（身份验证或其他）未设置标头。请启用完整的服务器日志记录，并粘贴相关日志。您可以在 Spring 属性文件中使用logging.level.org.springframework=TRACE。在那里你将能够看到它是否是由于缺少权限、错误的 URL 或其他原因。
disable default config add in .property file spring.autoconfigure.exclude[0]=org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration
您应该检查浏览器中的Network 选项卡，并检查响应中是否存在此标头。后端的5xx（内部服务器错误）在chrome（其他浏览器没试过）浏览器中会抛出Access-Control-Allow-Origin。

标签： java angular web-services

【解决方案1】：

试试这个：

 @Bean
public CorsConfigurationSource corsConfigurationSource() {
    String localURI = "http://localhost:4200";

    List<String> allowedOrigins = List.of(localURI);
    final CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(allowedOrigins);
    configuration.setAllowedMethods(java.util.List.of("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));
    // setAllowCredentials(true) is important, otherwise:
    // The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
    configuration.setAllowCredentials(true);
    // setAllowedHeaders is important! Without it, OPTIONS preflight request
    // will fail with 403 Invalid CORS request
    configuration.setAllowedHeaders(java.util.List.of("Authorization", "Cache-Control", "Content-Type", "Access-Control-Allow-Origin"));
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

【讨论】：