什么是跨域?為什么會(huì)出現(xiàn)跨域

定義：當(dāng)一個(gè)請(qǐng)求url的協(xié)議、域名、端口三者之間任意一個(gè)與當(dāng)前頁面url不同即為跨域。

原因：在前后端分離的模式下，前后端的域名是不一致的，此時(shí)就會(huì)發(fā)生跨域訪問問題。在請(qǐng)求的過程中我們要想回去數(shù)據(jù)一般都是post/get請(qǐng)求，所以..跨域問題出現(xiàn)。

Java實(shí)現(xiàn)跨域方式

1. 返回新的 CorsFilter(全局跨域)

package org.chuancey.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;
@Configuration
public class GlobalCorsConfig {
    @Bean
    public CorsFilter corsFilter() {
        //1. 添加 CORS配置信息
        CorsConfiguration config = new CorsConfiguration();
        // 放行哪些原始域
        config.addAllowedOrigin("*");
        // 是否發(fā)送 Cookie
        config.setAllowCredentials(true);
        // 放行哪些請(qǐng)求方式
        config.addAllowedMethod("*");
        // 放行哪些原始請(qǐng)求頭部信息
        config.addAllowedHeader("*");
        // 暴露哪些頭部信息
        config.addExposedHeader("*");
        //2. 添加映射路徑
        UrlBasedCorsConfigurationSource corsConfigurationSource = new UrlBasedCorsConfigurationSource();
        corsConfigurationSource.registerCorsConfiguration("/**",config);
        //3. 返回新的CorsFilter
        return new CorsFilter(corsConfigurationSource);
    }
}

2. 重寫 WebMvcConfigurer(全局跨域)

package org.chuancey.config;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
public class CorsConfig implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                //放行哪些原始域
                .allowedOrigins("*")
                .allowedHeaders("*")
                // 是否發(fā)送Cookie
                .allowCredentials(true)
                .allowedMethods("GET", "POST", "OPTIONS", "DELETE", "PUT", "PATCH")
                .maxAge(3600);
    }
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/**")
                .addResourceLocations("classpath:/static/");
        registry.addResourceHandler("swagger-ui.html")
                .addResourceLocations("classpath:/META-INF/resources/");
        registry.addResourceHandler("doc.html")
                .addResourceLocations("classpath:/META-INF/resources/");
        registry.addResourceHandler("/webjars/**")
                .addResourceLocations("classpath:/META-INF/resources/webjars/");
    }
}

3. 使用注解 (局部跨域)

在控制器(類上)上使用注解 @CrossOrigin，表示該類的所有方法允許跨域。

@RestController
@CrossOrigin(origins = "*")
public class VerificationController {
}

在方法上使用注解 @CrossOrigin

@PostMapping("/check/phone")
    @CrossOrigin(origins = "*")
    public boolean checkPhoneNumber(@RequestBody @ApiParam VerificationPojo verification) throws BusinessException {
        return false;
    }

4. 手動(dòng)設(shè)置響應(yīng)頭(局部跨域)

使用 HttpServletResponse 對(duì)象添加響應(yīng)頭(Access-Control-Allow-Origin)來授權(quán)原始域，這里 Origin的值也可以設(shè)置為 “*”,表示全部放行。

@RequestMapping("/home")
public String home(HttpServletResponse response) {
    response.addHeader("Access-Allow-Control-Origin","*");
    return "home";
}

5. 使用自定義filter實(shí)現(xiàn)跨域

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;
import org.springframework.stereotype.Component;
@Slf4j
@Configuration
@WebFilter(filterName = "accessFilter", urlPatterns = "/*")
public class MyCorsFilter implements Filter {
  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    HttpServletResponse response = (HttpServletResponse) res;
    response.setHeader("Access-Control-Allow-Origin", "*");
    response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
    response.setHeader("Access-Control-Max-Age", "3600");
    response.setHeader("Access-Control-Allow-Headers", "x-requested-with,content-type");
    chain.doFilter(req, res);
  }
  public void init(FilterConfig filterConfig) {log.info("AccessFilter過濾器初始化！");}
  public void destroy() {}
}

xml使自定義Filter生效方式

<!-- 跨域訪問 START-->
<filter>
 <filter-name>CorsFilter</filter-name>
 <filter-class>org.chuancey.filter.MyCorsFilter</filter-class>
</filter>
<filter-mapping>
 <filter-name>CorsFilter</filter-name>
 <url-pattern>/*</url-pattern>
</filter-mapping>
<!-- 跨域訪問 END  -->