springboot多种跨域方式

最新推荐文章于 2026-02-27 00:08:42 发布

原创最新推荐文章于 2026-02-27 00:08:42 发布 · 442 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

收录于

java

本文介绍了三种跨域处理方式：通过WebMvcConfigurer配置、过滤器实现及两者结合，详细解析了各自的适用场景与限制。

方式一：通过在webMvcConfigurer配置跨域，但是当有拦截器的时候，无法对拦截器进行跨域处理。

package com.fx110.api.site.aspect;

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

/**
 * @description: 这是描述
 * @author: DK
 * @create: 2020-03-19 16:47
 **/
@Configuration
public class CorsConfig implements WebMvcConfigurer {
    //统一配置跨域
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedOrigins("*")
                .allowedMethods("*")
                .allowedHeaders("*")
                .exposedHeaders("access-control-allow-headers",
                        "access-control-allow-methods",
                        "access-control-allow-origin",
                        "access-control-max-age",
                        "X-Frame-Options")
                .allowCredentials(true).maxAge(3600);
    }
}

方式二：通过过滤器跨域，不通过spring自带的跨域配置，手写跨域限制，会有ie无法支持 Access-Control-Allow-Headers：* 的操作，需要一一列举出来。


package com.fx110.api.site.aspect;

import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;


/**
 * @description: 过滤器跨域
 * @author: DK
 * @create: 2020-03-19 16:47
 **/

@Component
@WebFilter(urlPatterns = "/**", filterName = "CorsFilter")
public class CorsFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) {}

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT, GET");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "*");
        filterChain.doFilter(request, response);
    }

    @Override
    public void destroy() {}
}

方式三：结合过滤器和spring自带的跨域配置。

package com.fx110.api.site.aspect;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;


@Configuration
public class CorsConfig {
    private CorsConfiguration buildConfig() {
        CorsConfiguration corsConfiguration = new CorsConfiguration();
        corsConfiguration.addAllowedOrigin("*"); // 1允许任何域名使用
        corsConfiguration.addAllowedHeader("*"); // 2允许任何头
        corsConfiguration.addAllowedMethod("*"); // 3允许任何方法（post、get等）
        return corsConfiguration;
    }

    @Bean
    public CorsFilter corsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", buildConfig()); // 4
        return new CorsFilter(source);
    }
}

标签

#spring