Springboot 跨域拦截器配置说明

错误代码

跨域设置

java 复制代码

@Configuration
public class WebConfig implements WebMvcConfigurer {

    /**
     * cors 跨域配置
     */
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedMethods("GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS")
                .allowCredentials(true)
                .allowedOriginPatterns("*")
                .allowCredentials(true)
                .maxAge(3600);
    }
}

业务拦截器

java 复制代码

public class LoginInterceptor implements HandlerInterceptor {

    // 白名单
    private static final Set<String> whiteList = new HashSet<>();

    static {
        whiteList.add("/index.html");
    }

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        System.out.println(request.getMethod());
        String url = request.getServletPath();
        if (whiteMatcher(url)) {
            return true;
        }
        String token = request.getHeader(tokenConfig.getHeader());
        System.out.println(token);
        return true;
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable Exception ex) throws Exception {
        LoginCache.removeUser(); // 从当前线程移除登录用户信息
    }
}

问题

业务拦截其中可能会拦截到"OPTIONS"类型的请求。

正确代码

java 复制代码

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;

import java.util.Arrays;
import java.util.Collections;

@Configuration
public class CorsConfig {

    @Bean
    public CorsFilter corsFilter() {
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowedOriginPatterns(Collections.singletonList("*"));
        config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
        config.setAllowedHeaders(Collections.singletonList("*"));
        config.setAllowCredentials(true);
        config.setMaxAge(86400L);

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", config);

        return new CorsFilter(source);
    }
}

底层代码说明

WebMvcConfigurer 方式：通过 addCorsMappings 配置的 CORS 规则会被封装为 HandlerMapping 级别的 CORS 处理器，它在 DispatcherServlet 处理请求时才会生效。
CorsFilter 方式：直接注册 CorsFilter 作为一个独立的过滤器，它在 FilterChain 最前端执行，早于 DispatcherServlet 和所有拦截器。