Spring security addCorsMappings 没有效果

Question

我正在使用 angular 5.0.5 和 spring boot 2.0.2.RELEASE

angular 在 localhost:4200 上运行 spring 在 localhost:8181 上运行

试图在 spring security 中配置 cors，所以我在 WebSecurityConfigurerAdapter 中启用了 cors

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and()
                .csrf().disable()
                .authorizeRequests().antMatchers(authorizedPaths).permitAll()
                .anyRequest().authenticated()
                .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and().addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
    }

并且我使用 WebMvcConfigurer 进行 cors 配置，但即使我输入假原点并将 httpMethod 限制为仅 DELETE 我的 Angular 应用程序仍然可以访问后端并且不会像我没有任何一样被拒绝cors配置

@Configuration
@EnableWebMvc
public class WebMvcConfigurerImpl implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedOrigins("http://fake-domain.com")
                .allowedMethods("DELETE")
                .allowedHeaders("header1", "header2", "header3")
                .exposedHeaders("header1", "header2")
                .allowCredentials(true)
                .maxAge(3600);
    }
}

即使使用邮递员，我仍然可以使用 HTTP 请求到达后端 在发布之前尝试让它工作已经有一段时间了，所以我有点绝望

Answer 1

您可以在扩展 WebSecurityConfigurerAdapter

的同一类中创建 CorsConfigurationSource bean

@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(asList("*"));
    configuration.setAllowedMethods(asList("HEAD",
            "GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"));
    // setAllowCredentials(true) is important, otherwise:
    // The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
    configuration.setAllowCredentials(true);
    // setAllowedHeaders is important! Without it, OPTIONS preflight request
    // will fail with 403 Invalid CORS request
    configuration.setAllowedHeaders(
            asList("Authorization", "Cache-Control", "Content-Type", "Access-Control-Allow-Origin",
                    "Access-Control-Expose-Headers", "Access-Control-Allow-Headers"));
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

请参考https://github.com/techiesantosh/taskmanager-service/blob/develop/src/main/java/com/web/taskmanager/config/TaskConfig.java