在访问令牌 url 中启用 CORS - SPRING

Question

我正在做一个简单的弹簧安全项目。我使用 Angular 作为前端。对于身份验证，我从后端调用访问令牌，但春季没有任何 CORS 启用。如何启用 CORS。这是获取访问令牌的代码

<http pattern="/oauth/token" create-session="stateless" 
          authentication-manager-ref="clientAuthenticationManager"
          xmlns="http://www.springframework.org/schema/security">
        <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/>
        <anonymous enabled="false" />
        <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
        <!-- include this only if you need to authenticate clients via request 
        parameters -->
        <custom-filter ref="clientCredentialsTokenEndpointFilter"
                       after="BASIC_AUTH_FILTER" />
        <access-denied-handler ref="oauthAccessDeniedHandler" />
    </http>

Answer 1

抱歉，我不知道如何通过 XML 来实现，但在我的基于注释的配置中，CORS 是这样启用的：

import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport;    

@Configuration
public class WebApiConfiguration extends WebMvcConfigurationSupport {
    @Override
    protected void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
                .allowedMethods(
                        HttpMethod.GET.name(),
                        HttpMethod.POST.name(),
                        HttpMethod.PUT.name(),
                        HttpMethod.PATCH.name(),
                        HttpMethod.HEAD.name(),
                        HttpMethod.DELETE.name()
               );
    }
}

Answer 2

启用 CORS 的 XML 配置是，

 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:mvc="http://www.springframework.org/schema/mvc"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans       
   http://www.springframework.org/schema/beans/spring-beans.xsd
   http://www.springframework.org/schema/mvc  
   http://www.springframework.org/schema/mvc/spring-mvc.xsd">

  <mvc:annotation-driven />

  <mvc:cors>

    <mvc:mapping path="/api/**" allowed-origins="http://domain1.com, http://domain2.com"
                 allowed-methods="GET, PUT" allowed-headers="header1, header2, header3"
                 exposed-headers="header1, header2" allow-credentials="false" max-age="123" />

    <mvc:mapping path="/resources/**" allowed-origins="http://domain1.com" />

  </mvc:cors>

 </beans>