spring - 如何在 Spring Boot 2.x 中将 CORS 添加到 outh2/resource 服务器？

问题描述

我有一个使用 JWT 创建的 oauth 服务器和一个资源服务器。

我还创建了一个带有 2 个按钮的角前端：

第一个按钮调用认证服务器并获取 JWT 令牌并将其添加到输入框中。

第二个按钮使用 JWT 令牌作为不记名授权 http 标头调用其余服务器。

从 PostMan 调用 2 个服务可以完美运行，但我无法为后端服务正确配置 CORS 设置。

两个按钮都给我以下错误：

Access to XMLHttpRequest at 'http://localhost:8085/oauth/token' from origin 'http://localhost:4200' has been blocked by CORS policy: Request header field authorization is not allowed by Access-Control-Allow-Headers in preflight response.

我将所有 3 个项目添加到我的公共 github 存储库中。

我尝试通过多种方式添加 CORS：

资源休息服务上的配置较小，所以我将概述在这里我尝试在方法中添加默认值.cors()以及HttpSecurity手动设置它corsConfigurationSource()。

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        http.csrf().disable()
                .cors()
                .and().authorizeRequests().anyRequest().authenticated()
                .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER);

        //I tried manually configured the cors as well
        /*http.csrf().disable()
                .cors().configurationSource(corsConfigurationSource())
                .and().authorizeRequests().anyRequest().authenticated();
                .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER);*/
    }

   /* @Bean
    CorsConfigurationSource corsConfigurationSource() {
        final CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("*"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST"));
        configuration.setAllowCredentials(true);
        //the below three lines will add the relevant CORS response headers
        configuration.addAllowedOrigin("*");
        configuration.addAllowedHeader("*");
        configuration.addAllowedMethod("*");
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
  */
}

我还尝试添加一个 servlet 过滤器

@Component @Order(Ordered.HIGHEST_PRECEDENCE) public class SimpleCorsFilter 实现 Filter { @Override public void init(final FilterConfig filterConfig) throws ServletException {

}
@Override
public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws

IOException, ServletException {

    final HttpServletResponse response = (HttpServletResponse) servletResponse;
    final HttpServletRequest request = (HttpServletRequest) servletRequest;

    response.addHeader("Access-Control-Allow-Origin", "*");
    response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS");
    response.setHeader("Access-Control-Max-Age", "3600");
    response.setHeader("Access-Control-Allow-Headers", "content-type, x-requested-with, authorisation");

    if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
        response.setStatus(HttpServletResponse.SC_OK);
    } else {
        filterChain.doFilter(servletRequest, servletResponse);
    }

}
@Override
public void destroy() {

} }

只是无法让它工作。任何人都可以在这里给我一些指导吗？

标签： springspring-bootspring-securityoauth-2.0

spring - 如何在 Spring Boot 2.x 中将 CORS 添加到 outh2/resource 服务器？

问题描述

解决方案

推荐阅读