CORS

以你之姓@ 2021-10-06 03:06 294阅读 0赞

### CORS ###

*  跨域请求CORS
 *  代码示例

# 跨域请求CORS #

CORS 全称为 Cross Origin Resource Sharing（跨域资源共享），服务端只需添加相关响应头信息，即可实现客户端发出 AJAX 跨域请求  
实现方式：  
服务端可通过任何编程语言来实现，只要能将 CORS 响应头写入 response 对象中即可。

# 代码示例 #

（1）编写filter  
过滤所有的 HTTP 请求

public class CorsFilter implements Filter {
        private String allowOrigin;
        private String allowMethods;
        private String allowCredentials;
        private String allowHeaders;
        private String exposeHeaders;
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
            allowOrigin = filterConfig.getInitParameter("allowOrigin");
            allowMethods = filterConfig.getInitParameter("allowMethods");
            allowCredentials = filterConfig.getInitParameter("allowCredentials");
            allowHeaders = filterConfig.getInitParameter("allowHeaders");
            exposeHeaders = filterConfig.getInitParameter("exposeHeaders");
        }
        @Override
        public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
            HttpServletRequest request = (HttpServletRequest) req;
            HttpServletResponse response = (HttpServletResponse) res;
            if (StringUtil.isNotEmpty(allowOrigin)) {
                List<String> allowOriginList = Arrays.asList(allowOrigin.split(","));
                if (CollectionUtil.isNotEmpty(allowOriginList)) {
                    String currentOrigin = request.getHeader("Origin");
                    if (allowOriginList.contains(currentOrigin)) {
                        response.setHeader("Access-Control-Allow-Origin", currentOrigin);
                    }
                }
            }
            if (StringUtil.isNotEmpty(allowMethods)) {
                response.setHeader("Access-Control-Allow-Methods", allowMethods);
            }
            if (StringUtil.isNotEmpty(allowCredentials)) {
                response.setHeader("Access-Control-Allow-Credentials", allowCredentials);
            }
            if (StringUtil.isNotEmpty(allowHeaders)) {
                response.setHeader("Access-Control-Allow-Headers", allowHeaders);
            }
            if (StringUtil.isNotEmpty(exposeHeaders)) {
                response.setHeader("Access-Control-Expose-Headers", exposeHeaders);
            }
            chain.doFilter(req, res);
        }
        @Override
        public void destroy() {
        }
    }

（2）配置web.xml

<filter>
        <filter-name>corsFilter</filter-name>
        <filter-class>com.vander.api.cors.CorsFilter</filter-class>
        <init-param>
            <param-name>allowOrigin</param-name>
            <param-value>http://web.xxx.com</param-value>
        </init-param>
        <init-param>
            <param-name>allowMethods</param-name>
            <param-value>GET,POST,PUT,DELETE,OPTIONS</param-value>
        </init-param>
        <init-param>
            <param-name>allowCredentials</param-name>
            <param-value>true</param-value>
        </init-param>
        <init-param>
            <param-name>allowHeaders</param-name>
            <param-value>Content-Type</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>corsFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

说明：  
Access-Control-Allow-Origin：允许访问的客户端域名，例如：[http://web.xxx.com][http_web.xxx.com]，若为 \*，则表示从任意域都能访问，即不做任何限制；  
Access-Control-Allow-Methods：允许访问的方法名，多个方法名用逗号分割，例如：GET,POST,PUT,DELETE,OPTIONS；  
Access-Control-Allow-Credentials：是否允许请求带有验证信息，若要获取客户端域下的 cookie 时，需要将其设置为 true；  
Access-Control-Allow-Headers：允许服务端访问的客户端请求头，多个请求头用逗号分割，例如：Content-Type；  
Access-Control-Expose-Headers：允许客户端访问的服务端响应头，多个响应头用逗号分割。

[http_web.xxx.com]: http://web.xxx.com