欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识！
您现在的位置是： 首页

java tomcat-catalina CorsFilter使用，apache tomcat-catalina CorsFilter使用，Springboot

程序员文章站 2022-07-13 07:58:50
...

java tomcat-catalina CorsFilter使用，apache tomcat-catalina CorsFilter使用，Springboot CORS跨域

 

================================

©Copyright 蕃薯耀 2020-11-26

http://fanshuyao.iteye.com/

 

org.apache.catalina.filters.CorsFilter为apache （tomcat-catalina）组件。

一、官网地址

http://tomcat.apache.org/tomcat-9.0-doc/config/filter.html

 

二、Springboot使用cors-filter

1、引入依赖

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-catalina</artifactId>
    <version>9.0.40</version>
    <exclusions>
    <exclusion>
        <groupId>org.apache.tomcat</groupId>
        <artifactId>*</artifactId>
    </exclusion>
    </exclusions>
</dependency>

 

2、配置类

import javax.servlet.Filter;

import org.apache.catalina.filters.CorsFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

/**
 * apache CorsFilter过滤器配置类
 */
@Configuration
public class HttpFilterConfig {

    /**
     * apache提供的跨域访问过滤器：org.apache.catalina.filters.CorsFilter
     * @return
     */
    @Bean
    public FilterRegistrationBean<Filter> corsFilter() {
        FilterRegistrationBean<Filter> registration = new FilterRegistrationBean<>();
        
        registration.setFilter(new CorsFilter());//org.apache.catalina.filters.CorsFilter
        
        //这个要设置成true
        //Defaults: false
        registration.addInitParameter("cors.support.credentials", "true");
        
        //这个默认是不允许访问的，可直接设置成 *
        //Defaults: The empty String. (No origin is allowed to access the resource).
        registration.addInitParameter("cors.allowed.origins", "http://127.0.0.1:7010");
        
        //这个可直接不配置
        //Defaults: GET, POST, HEAD, OPTIONS
        //registration.addInitParameter("cors.allowed.methods", "GET,POST");
        
        //这个可直接不配置
        //Defaults: Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
        //registration.addInitParameter("cors.allowed.headers", "*");
        
        //这个可直接不配置
        //Default: None
        //registration.addInitParameter("cors.exposed.headers", "");
        
        //这个可直接不配置
        //Defaults: 1800。3600表示一个小时
        //registration.addInitParameter("cors.preflight.maxage", "3600");
        
        //这个可直接不配置
        //A flag to control if the request should be decorated or not. Defaults: true
        //registration.addInitParameter("cors.request.decorate", "true");
        
        
        registration.setName("CORSFilter"); //过滤器名称
        registration.addUrlPatterns("/*");//过滤路径
        registration.setOrder(1);//设置顺序
        return registration;
    }    
}

 

 

三、Spring Web应用使用cors-filter

1、引入Jar包，放在项目的/WEB-INF/lib/目录下

tomcat-catalina-9.0.40.jar

下载地址：

https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-catalina/9.0.40/tomcat-catalina-9.0.40.jar

 

 

2、在WEB-INF/web.xml配置过滤器

<filter>
    <filter-name>CorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>CorsFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

 

 

四、参数说明

 

cors.allowed.origins
A list of origins that are allowed to access the resource. A * can be specified to enable access to resource from any origin. Otherwise, an allow list of comma separated origins can be provided. Eg: https://www.w3.org, https://www.apache.org. Defaults: The empty String. (No origin is allowed to access the resource).

 

cors.allowed.methods
A comma separated list of HTTP methods that can be used to access the resource, using cross-origin requests. These are the methods which will also be included as part of Access-Control-Allow-Methods header in pre-flight response. Eg: GET, POST. Defaults: GET, POST, HEAD, OPTIONS

 

cors.allowed.headers
A comma separated list of request headers that can be used when making an actual request. These headers will also be returned as part of Access-Control-Allow-Headers header in a pre-flight response. Eg: Origin,Accept. Defaults: Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers

 

cors.exposed.headers
A comma separated list of headers other than simple response headers that browsers are allowed to access. These are the headers which will also be included as part of Access-Control-Expose-Headers header in the pre-flight response. Eg: X-CUSTOM-HEADER-PING,X-CUSTOM-HEADER-PONG. Default: None. Non-simple headers are not exposed by default.

 

cors.preflight.maxage
The amount of seconds, browser is allowed to cache the result of the pre-flight request. This will be included as part of Access-Control-Max-Age header in the pre-flight response. A negative value will prevent CORS Filter from adding this response header to pre-flight response. Defaults: 1800

 

cors.support.credentials
A flag that indicates whether the resource supports user credentials. This flag is exposed as part of Access-Control-Allow-Credentials header in a pre-flight response. It helps browser determine whether or not an actual request can be made using credentials. Defaults: false

 

cors.request.decorate
A flag to control if CORS specific attributes should be added to HttpServletRequest object or not. Defaults: true

 

参数配置示例（Xml）：

<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value>https://www.apache.org</param-value>
  </init-param>
  <init-param>
    <param-name>cors.allowed.methods</param-name>
    <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
  </init-param>
  <init-param>
    <param-name>cors.allowed.headers</param-name>
    <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
  </init-param>
  <init-param>
    <param-name>cors.exposed.headers</param-name>
    <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
  </init-param>
  <init-param>
    <param-name>cors.support.credentials</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>cors.preflight.maxage</param-name>
    <param-value>10</param-value>
  </init-param>
</filter>
<filter-mapping>
  <filter-name>CorsFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

 

 

spring CORS跨域请求解决方案总结：（建议采用方案1）

1、springboot CORS 跨域请求解决三大方案，springboot CorsFilter解决跨域问题

https://www.iteye.com/blog/fanshuyao-2517777

 

2、cors-filter使用，cors-filter解决跨域访问，cors-filter跨域请求

https://www.iteye.com/blog/fanshuyao-2517803

 

3、org.ebaysf.web的cors-filter使用，cors-filter跨域请求

https://www.iteye.com/blog/fanshuyao-2517820

 

4、java tomcat-catalina CorsFilter使用，apache tomcat-catalina CorsFilter使用

https://www.iteye.com/blog/fanshuyao-2517821

 

5、springboot jsonp 跨域请求，springboot使用jsonp跨域

https://www.iteye.com/blog/fanshuyao-2517789

 

================================

©Copyright 蕃薯耀 2020-11-26

http://fanshuyao.iteye.com/

 

 

相关标签： springboot cors跨域 apache tomcat-catalina CorsFilter使用 java tomcat-catalina CorsFilter使用 蕃薯耀 cors-filter跨域请求

上一篇： docker安装redis

下一篇： spring boot的应用程序单元测试方案

推荐阅读