在 servlet 中启用 CORS

Question

我在我的 servlet doPost 方法中使用了这个头方法来启用 CORS。尽管在获取 api 时我的 reactjs 应用程序中出现了 CORS 错误。 reactjs 错误在这里（错误：已被 CORS 策略阻止：对预检请求的响应未通过访问控制检查：请求的资源上不存在“Access-Control-Allow-Origin”标头。如果不透明的响应为您服务需要，将请求的模式设置为“no-cors”以获取禁用 CORS 的资源。）

    response.addHeader("Access-Control-Allow-Origin", "*");
    response.addHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT, DELETE, HEAD");
    response.addHeader("Access-Control-Allow-Headers", "X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept");
    response.addHeader("Access-Control-Max-Age", "1728000");

在 tomcat web.xml 中，我添加了下面给出的一堆代码。如何在 tomcat 中更改多个客户端的参数值，而不是像 (http://localhost:3000) 这样的固定 URL？

<filter>
<filter-name>CorsFilter</filter-name>
<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
<init-param>
<param-name>cors.allowed.origins</param-name>
<param-value>http://localhost:3000</param-value>
  **(How I can change param-value for multiple client instead of fixed URL)**
</init-param>
<init-param>
<param-name>cors.allowed.methods</param-name>
<param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
  </init-param>
    <init-param>
     <param-name>cors.allowed.headers</param-name>
     <param-value>Content-Type,X-Requested-With,accept,Origin,Access- 
      Control-Request-Method,Access-Control-Request-Headers</param-value>
  </init-param>
  <init-param>
      <param-name>cors.exposed.headers</param-name>
      <param-value>Access-Control-Allow-Origin,Access-Control-Allow- 
         Credentials</param-value>
  </init-param>
  <init-param>
     <param-name>cors.support.credentials</param-name>
     <param-value>true</param-value>
  </init-param>
  <init-param>
  <param-name>cors.preflight.maxage</param-name>
  <param-value>1800</param-value>
  </init-param>
  </filter>
  <filter-mapping>
  <filter-name>CorsFilter</filter-name>
  <url-pattern>/*</url-pattern>
  </filter-mapping>

Answer 1

它因不同的前端应用程序和后端而异.... 对于 Emberjs，在相应的 doGet 或 doPost 方法中添加这一行。

> response.addHeader("Access-Control-Allow-Origin", "http://localhost:4200");

（或）

> response.addHeader("Access-Control-Allow-Origin", "*"); (for all hosts)

对于 Tomcat 的 web.xml 配置，请遵循我在下面提到的这些步骤！..

https://tomcat.apache.org/tomcat-7.0-doc/config/filter.html#:~:text=The%20filter%20class%20name%20for%20the%20CORS%20Filter%20is%20org,catalina.

对于多个客户端 URL，只需将所有 URL 用逗号分隔

<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value> http://localhost:4200, http://localhost:3000 </param-value>
  </init-param>
</filter>

Answer 2

你可以创建一个新的过滤器，

@WebFilter(asyncSupported = true, urlPatterns = { "/*" })
public class CORSInterceptor implements Filter {

    private static final String[] allowedOrigins = {
            "http://localhost:3000", "http://localhost:5500", "http://localhost:5501",
            "http://127.0.0.1:3000", "http://127.0.0.1:5500", "http://127.0.0.1:5501"
    };

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;

        String requestOrigin = request.getHeader("Origin");
        if(isAllowedOrigin(requestOrigin)) {
            // Authorize the origin, all headers, and all methods
            ((HttpServletResponse) servletResponse).addHeader("Access-Control-Allow-Origin", requestOrigin);
            ((HttpServletResponse) servletResponse).addHeader("Access-Control-Allow-Headers", "*");
            ((HttpServletResponse) servletResponse).addHeader("Access-Control-Allow-Methods",
                    "GET, OPTIONS, HEAD, PUT, POST, DELETE");

            HttpServletResponse resp = (HttpServletResponse) servletResponse;

            // CORS handshake (pre-flight request)
            if (request.getMethod().equals("OPTIONS")) {
                resp.setStatus(HttpServletResponse.SC_ACCEPTED);
                return;
            }
        }
        // pass the request along the filter chain
        filterChain.doFilter(request, servletResponse);
    }

    private boolean isAllowedOrigin(String origin){
        for (String allowedOrigin : allowedOrigins) {
            if(origin.equals(allowedOrigin)) return true;
        }
        return false;
    }
}

这将允许所有指定的域、标头和方法。