Spring Security - 简单的 CORS 身份验证错误

Question

我有一个基于 Spring 的应用程序，它使用 Spring Security 来处理身份验证。我们的应用需要提供对简单跨域资源共享的支持，应用可以从'http://myApplication.myDomain.net'和'http://www.myApplication.myDomain.net'访问，我已经将我的简单CORS过滤器配置为允许多个请求来源，所以这两个域将具有 Access-Control-Allow-Origin 请求响应标头。问题是，当我从该域“http://myApplication.myDomain.net”访问应用程序时效果很好，但是当我尝试从这里“http://www.myApplication.myDomain.net”访问应用程序时，我只能登录但中间的以下请求显示主仪表板得到 403 - 禁止访问：访问被拒绝。 我正在使用 AngularJS 和 grunt，来自 Angular 的所有请求都发送到 http://myApplication.myDomain:8087/api/....

我的问题是，如何添加对两个域的支持？为什么日志记录请求有效，但禁止任何进一步的操作？

谢谢。

Answer 1

添加拦截器

public class CorsInterceptor extends HandlerInterceptorAdapter {

 public static final String CREDENTIALS_NAME = "Access-Control-Allow-Credentials";
 public static final String ORIGIN_NAME = "Access-Control-Allow-Origin";
 public static final String METHODS_NAME = "Access-Control-Allow-Methods";
 public static final String HEADERS_NAME = "Access-Control-Allow-Headers";
 public static final String MAX_AGE_NAME = "Access-Control-Max-Age";
 public static final String REQUEST_ORIGIN_NAME = "Origin";

private final List<String> origins;

    public CorsInterceptor(List<String> origins) {
        this.origins = origins;
    }

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        response.setHeader(CREDENTIALS_NAME, "true");
        response.setHeader(METHODS_NAME, "GET, OPTIONS, POST, PUT, DELETE");
        response.setHeader(HEADERS_NAME, "Origin, X-Requested-With, Content-Type, Accept");
        response.setHeader(MAX_AGE_NAME, "3600");

        String origin = request.getHeader(REQUEST_ORIGIN_NAME);
        if (origins.contains(origin)) {
            response.setHeader(ORIGIN_NAME, origin);
            return true; // Proceed
        }

        return false;
   }

}

在配置中

public class WebMvcConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new CorsInterceptor(Arrays.asList("'http://myApplication.myDomain.net","http://www.myApplication.myDomain.net")));
    }

    ...

}