場景及問題描述:
項目爲前後端分離,後臺項目使用Spring Boot框架整合了CAS Client。前端發起ajax請求到CAS Client,被CAS Filter攔截器重定向到CAS Server,出現CORS跨域問題 。
錯誤信息:
Chrome F12完整錯誤信息:
Failed to load [CAS client地址]: Redirect from '[CAS client地址]' to '[CAS server地址]' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '[前端地址]' is therefore not allowed access.
Chrome F12關鍵錯誤信息:
No 'Access-Control-Allow-Origin' header is present on the requested resource
解決方案:
1、CAS Client中定義一個跨域Filter,注意:跨域Filter優先級必須要高於CAS FIlter,否則請求會先被CAS Filter先行執行,加跨域Filter則無意義。這裏優先級設定爲@Order(value=0),高於CAS FIlter。
import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletResponse;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import java.io.IOException;
@Configuration
@Order(value=0)
@WebFilter(filterName = "CorsFilterConfig", urlPatterns = "/*")
public class CorsFilterConfig implements Filter {
@Override
public void init(FilterConfig filterConfig) throws ServletException {
System.out.println("===============CorsFilterConfig執行=================");
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
FilterChain filterChain) throws IOException, ServletException {
HttpServletResponse res = (HttpServletResponse) servletResponse;
res.setHeader("Access-Control-Allow-Origin", "*");
res.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
res.setHeader("Access-Control-Max-Age", "1728000");
res.setHeader("Access-Control-Allow-Headers",
"Authentication, Authorization, content-type, Accept, x-requested-with, Cache-Control");
filterChain.doFilter(servletRequest, res);
}
@Override
public void destroy() {}
}
2、CAS Server項目下找到web.xml,進行跨域Filter配置,但是需要下載java-property-utils和cors-filter jar包,放到lib下
<filter>
<filter-name>CORS</filter-name>
<filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>
<init-param>
<param-name>cors.allowOrigin</param-name>
<param-value>*</param-value>
</init-param>
<init-param>
<param-name>cors.supportedMethods</param-name>
<param-value>GET, POST, HEAD, PUT, DELETE</param-value>
</init-param>
<init-param>
<param-name>cors.supportedHeaders</param-name>
<param-value>Accept, Origin, X-Requested-With, Content-Type, Last-Modified</param-value>
</init-param>
<init-param>
<param-name>cors.exposedHeaders</param-name>
<param-value>Set-Cookie</param-value>
</init-param>
<init-param>
<param-name>cors.supportsCredentials</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CORS</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
注意:如果只進行第1步對CAS Client跨域配置,不進行第2步對CAS Server跨域配置,則會出現以下錯誤信息:
Failed to load [CAS server地址?service=url]: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.
找了幾篇CORS相關文章,感謝作者分享精神:
http://www.ruanyifeng.com/blog/2016/04/same-origin-policy.html