Spring boot OAuth2 - OAuth Token不返回授权令牌

Question

我遇到了这个错误。

XMLHttpRequest cannot load http://localhost:8080/oauth/token. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access. The response had HTTP status code 401.

我已经添加了我的 cors 过滤器。

@Component
public class CorsFilter implements Filter {

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
        response.setHeader("Access-Control-Allow-Credentials", "true");
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "origin,Content-Type, Accept, X-Requested-With, remember-me");
        if(request.getHeader("request").equalsIgnoreCase("options")) {
            response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
        }
        chain.doFilter(req, res);
    }

    @Override
    public void init(FilterConfig filterConfig) {
    }

    @Override
    public void destroy() {
    }

}

可能安全配置是这样的。

  //Added Swagger to ignore lists
        http.authorizeRequests()
                .antMatchers(
                        "/swagger-ui.html",
                        "/webjars/springfox-swagger-ui/**",
                        "/configuration/ui",
                        "/oauth/token",
                        "/v2/**",
                        "/register",
                        "/swagger-resources",
                        "/clinic",
                        "/reindex",
                        "/rating/featured-rating",
                        "/doctor/*",
                        "/doctor/clinic/*",
                        "/doctor/profile/*",
                        "/clinic/profile/*",
                        "/**/*.html",
                        "/app/**",
                        "/assets/**",
                        "/fonts/*",
                        "/styles/images/*",
                        "/",
                        "/search-term",
                        "/search/detail",
                        "/location",
                        "/verify",
                        "/register",
                        "/doctor/register/request",
                        "/rating/create",
                        "/rating/has-like",
                        "/rating/like",
                        "/doctor/download/**",
                        "/clinic/download/**",
                        "/patient/references/*",
                        "/vanilla",
                        "/rating/featured-rating",
                        "/reset",
                        "/validate-pass",
                        "/change-pass",
                        "/save-pass",
                        "/users",
                        "/events/report").permitAll()
                .anyRequest().authenticated()
                .and().csrf().disable();

        http.authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll();
        http.headers()
                .xssProtection().and()
                .cacheControl().and()
                .httpStrictTransportSecurity().and()
                .frameOptions();

这是我的错误截图

我还错过了什么？

编辑

我已将我的 cors 配置更新为以下内容

import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Enumeration;

    @Component
    @Order(Ordered.HIGHEST_PRECEDENCE)
    public class CorsFilter implements Filter {

        @Override
        public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

            HttpServletRequest request = (HttpServletRequest) req;
            HttpServletResponse response = (HttpServletResponse) res;
            response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
            response.setHeader("Access-Control-Allow-Credentials", "true");
            response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
            response.setHeader("Access-Control-Max-Age", "3600");
            response.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me");

            request.getHeaderNames();

            if(request.getMethod().equalsIgnoreCase("OPTIONS")) {
            } else {
                chain.doFilter(req, res);
            }

            //chain.doFilter(req, res);
        }

        @Override
        public void init(FilterConfig filterConfig) {
        }

        @Override
        public void destroy() {
        }

    }

但是，现在的响应是这样的

为了调用 /oauth/token 的目的，此应用程序所需的授权令牌没有响应

Answer 1

按照this post你需要做两处改动：

1. 通过添加@Ordered 注解，确保在 Spring Security 过滤器之前加载过滤器。

   import org.springframework.core.Ordered;
   import org.springframework.core.annotation.Order;
   
   @Component
   @Order(Ordered.HIGHEST_PRECEDENCE)
   class CorsFilter implements Filter {
   

2. 您应该中断 OPTION 请求方法的过滤器链。

   if(request.getHeader("request").equalsIgnoreCase("options")) {
       // ...
   } else {
       chain.doFilter(req, res);
   }
   

另外，我不太明白你为什么在 if 语句中设置 Access-Control-Allow-Origin 标头，因为你在条件之前这样做了。