为什么 CORS 不能与 Spring Security 6 一起使用？

Question

我尝试使用@ch4mp 的回答来应用 CORS 配置：Use Keycloak Spring Adapter with Spring Boot 3

并且还遵循了这里的指南： https://docs.spring.io/spring-security/reference/servlet/integrations/cors.html

问题是，当我检查它时，我在响应中看不到 CORS 标头，如下所示：https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-test-cors.html

我想在全球范围内配置 CORS，我们将不胜感激。

@Configuration
@EnableWebSecurity
@Order(Ordered.HIGHEST_PRECEDENCE)
public class SecurityConfig {

    @Value("${eval.required.role.name}")
    private String requiredRoleName;


    @Bean
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http, KeycloakLogoutHandler keycloakLogoutHandler, Jwt2AuthenticationConverter authenticationConverter, ServerProperties serverProperties) throws Exception {

        // If SSL enabled, disable http (https only)
        if (serverProperties.getSsl() != null && serverProperties.getSsl().isEnabled()) {
            http.requiresChannel().anyRequest().requiresSecure();
        } else {
            http.requiresChannel().anyRequest().requiresInsecure();
        }

        CookieCsrfTokenRepository tokenRepository = CookieCsrfTokenRepository.withHttpOnlyFalse();
        XorCsrfTokenRequestAttributeHandler delegate = new XorCsrfTokenRequestAttributeHandler();
        delegate.setCsrfRequestAttributeName("_csrf");

        CsrfTokenRequestHandler requestHandler = delegate::handle;

        http.cors(withDefaults());

        http.authorizeRequests(auth -> {
            auth.requestMatchers("/**").hasAuthority(requiredRoleName);
            auth.anyRequest().fullyAuthenticated();
        });

        http.oauth2ResourceServer().jwt().jwtAuthenticationConverter(authenticationConverter);

        http.oauth2Login()
                .and()
                .logout()
                .addLogoutHandler(keycloakLogoutHandler)
                .logoutSuccessUrl("/");

        http.csrf(csrf -> csrf
                .csrfTokenRepository(tokenRepository)
                .csrfTokenRequestHandler(requestHandler));

        return http.build();
    }

    @Bean
    public Jwt2AuthoritiesConverter authoritiesConverter() {
        // This is a converter for roles, as embedded in the JWT by a Keycloak server
        return jwt -> {
            final var realmAccess = (Map<String, Object>) jwt.getClaims().getOrDefault("realm_access", Map.of());
            final var realmRoles = (Collection<String>) realmAccess.getOrDefault("roles", List.of());

            return realmRoles.stream().map(SimpleGrantedAuthority::new).toList();
        };
    }

    @Bean
    public Jwt2AuthenticationConverter authenticationConverter(Jwt2AuthoritiesConverter authoritiesConverter) {
        return jwt -> new JwtAuthenticationToken(jwt, authoritiesConverter.convert(jwt));
    }

    public interface Jwt2AuthoritiesConverter extends Converter<Jwt, Collection<? extends GrantedAuthority>> {
    }

    public interface Jwt2AuthenticationConverter extends Converter<Jwt, AbstractAuthenticationToken> {
    }



}


}

以及 CORS 配置：

@Component
public class CustomCorsConfiguration {

    @Value("${eval.cors.origin}")//*
    private String corsOrigin;

    @Value("${eval.cors.methods}")//"GET", "POST", "DELETE", "PUT", "OPTIONS"
    private List<String> corsMethods

    @Value("${eval.cors.header}")//*
    private String corsHeaders;

    @Value("${eval.cors.credentials}")//true
    private boolean corsCredentials;

    @Value("${eval.cors.maxAge}")//180
    private Long corsMaxAge;

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList(corsOrigin));
        configuration.setAllowedMethods(corsMethods);
        configuration.setAllowedHeaders(Arrays.asList(corsHeaders));
        configuration.setAllowCredentials(corsCredentials);
        configuration.setMaxAge(corsMaxAge);

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);

        return source;
    }

}

Answer 1

如何检查 CORS 是否与 Spring Boot 3 一起工作？

将OPTIONS 请求发送到感兴趣的端点并检查是否存在所需的标头