CORS & Spring CORS

1
2
3
Origin: https://www.baidu.com     //表示请求来源
Access-Control-Request-Method: GET  //请求所使用方法
Access-Control-Request-Headers: Header-1, Header-2 //请求将携带的Headers

1
2
3
4
5
Access-Control-Allow-Origin: https://www.baidu.com  //服务器允许的源，*表示所有源都可以跨域
Access-Control-Allow-Methods: POST, GET, OPTIONS //支持的所有跨域请求的方法
Access-Control-Allow-Headers: Header-1, Header-2  //支持的所有跨域请求头
Access-Control-Max-Age: 86400  //不一定有，表明该响应的有效时间（秒）。在有效时间内，浏览器无须为同一请求再次发起预检请求
Access-Control-Expose-Headers: Header-3, Header-4 //不一定有，默认情况下只有几种Header会暴露，可以通过它配置需要暴露的Header

1
Access-Control-Allow-Credentials: true  //另外，当允许附带Credentials时，Access-Control-Allow-Origin不能用*

1
2
3
4
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
如果服务端指定了具体的域名而非“*”，那么响应首部中的 Vary 字段的值必须包含 Origin。这将告诉客户端：服务器对不同的源站返回不同的内容。（不过Spring目前是都会返回）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
public class CorsConfiguration {
   ......
   @Nullable
   private List<String> allowedOrigins;  //后端允许的源，对应Access-Control-Allow-Origin

   @Nullable
   private List<OriginPattern> allowedOriginPatterns; //也可使用Pattern动态匹配源

   @Nullable
   private List<String> allowedMethods;  //后端允许的请求方法

   @Nullable
   private List<HttpMethod> resolvedMethods = DEFAULT_METHODS; //后端允许的请求方法

   @Nullable
   private List<String> allowedHeaders;  //后端允许的请求头

   @Nullable
   private List<String> exposedHeaders; //对应Access-Control-Expose-Headers

   @Nullable
   private Boolean allowCredentials; //是否允许携带凭证，对应Access-Control-Allow-Credentials

   @Nullable
   private Long maxAge; //预检请求有效时间，对应Access-Control-Max-Age

   ......
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
......

private final Map<HandlerMethod, CorsConfiguration> corsLookup = new ConcurrentHashMap<>();

......

public void register(T mapping, Object handler, Method method) {
   ......
//根据initCorsConfiguration模板方法获取CORS配置
      CorsConfiguration corsConfig = initCorsConfiguration(handler, method, mapping);
      if (corsConfig != null) {
         corsConfig.validateAllowCredentials();
         //校验通过后将CORS配置缓存在Map中
         this.corsLookup.put(handlerMethod, corsConfig); 
      }

      this.registry.put(mapping,
            new MappingRegistration<>(mapping, handlerMethod, directPaths, name, corsConfig != null));
    ......
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
//获取@CrossOrigin，最终生成CorsConfiguration
@Override
protected CorsConfiguration initCorsConfiguration(Object handler, Method method, RequestMappingInfo mappingInfo) {
   HandlerMethod handlerMethod = createHandlerMethod(handler, method);
   Class<?> beanType = handlerMethod.getBeanType();
   CrossOrigin typeAnnotation = AnnotatedElementUtils.findMergedAnnotation(beanType, CrossOrigin.class);
   CrossOrigin methodAnnotation = AnnotatedElementUtils.findMergedAnnotation(method, CrossOrigin.class);

   if (typeAnnotation == null && methodAnnotation == null) {
      return null;
   }

   CorsConfiguration config = new CorsConfiguration();
   updateCorsConfig(config, typeAnnotation);
   updateCorsConfig(config, methodAnnotation);

   if (CollectionUtils.isEmpty(config.getAllowedMethods())) {
      for (RequestMethod allowedMethod : mappingInfo.getMethodsCondition().getMethods()) {
         config.addAllowedMethod(allowedMethod.name());
      }
   }
   return config.applyPermitDefaultValues();
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
public final HandlerExecutionChain getHandler(HttpServletRequest request) throws Exception {
......
//判断是否有CORS配置或者是否预检请求
   if (hasCorsConfigurationSource(handler) || CorsUtils.isPreFlightRequest(request)) {
   //获取CORS配置
      CorsConfiguration config = getCorsConfiguration(handler, request);
      if (getCorsConfigurationSource() != null) {
         CorsConfiguration globalConfig = getCorsConfigurationSource().getCorsConfiguration(request);
         config = (globalConfig != null ? globalConfig.combine(config) : config);
      }
      if (config != null) {
         config.validateAllowCredentials();
      }
      //添加拦截器
      executionChain = getCorsHandlerExecutionChain(request, executionChain, config);
   }

   return executionChain;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
protected HandlerExecutionChain getCorsHandlerExecutionChain(HttpServletRequest request,
		HandlerExecutionChain chain, @Nullable CorsConfiguration config) {

	if (CorsUtils.isPreFlightRequest(request)) {
		HandlerInterceptor[] interceptors = chain.getInterceptors();
		return new HandlerExecutionChain(new PreFlightHandler(config), interceptors);
	}
	else {
	//最终会根据CorsConfiguration创建CorsInterceptor
		chain.addInterceptor(0, new CorsInterceptor(config));
		return chain;
	}
}

1
2
3
4
5
6
7
8
9
10
@Configuration
public class CustomizeWebConfig implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedOrigins(CorsConfiguration.ALL)
                .allowedMethods(CorsConfiguration.ALL)
                .allowedHeaders(CorsConfiguration.ALL);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
public final HandlerExecutionChain getHandler(HttpServletRequest request) throws Exception {
......
   if (hasCorsConfigurationSource(handler) || CorsUtils.isPreFlightRequest(request)) {
      CorsConfiguration config = getCorsConfiguration(handler, request);
      if (getCorsConfigurationSource() != null) {
      //获取CorsConfigurationSource，根据CorsConfigurationSource获取全局CorsConfiguration
         CorsConfiguration globalConfig = getCorsConfigurationSource().getCorsConfiguration(request);
         //将全局配置与细粒度配置结合
         config = (globalConfig != null ? globalConfig.combine(config) : config);
      }
      if (config != null) {
         config.validateAllowCredentials();
      }
      executionChain = getCorsHandlerExecutionChain(request, executionChain, config);
   }

   return executionChain;
}

1
2
3
4
5
6
7
8
9
10
@Bean
public CorsFilter corsFilter() {
    UrlBasedCorsConfigurationSource source=  new UrlBasedCorsConfigurationSource();
    CorsConfiguration corsConfiguration = new CorsConfiguration();
    corsConfiguration.addAllowedOrigin(CorsConfiguration.ALL);
    corsConfiguration.addAllowedMethod(CorsConfiguration.ALL);
    corsConfiguration.addAllowedHeader(CorsConfiguration.ALL);
    source.registerCorsConfiguration("/**", corsConfiguration);
    return new CorsFilter(source);
}