Springboot 跨域拦截器配置说明

错误代码

• 跨域设置

@Configuration
public class WebConfig implements WebMvcConfigurer {/*** cors 跨域配置*/@Overridepublic void addCorsMappings(CorsRegistry registry) {registry.addMapping("/**").allowedMethods("GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS").allowCredentials(true).allowedOriginPatterns("*").allowCredentials(true).maxAge(3600);}
}

• 业务拦截器

public class LoginInterceptor implements HandlerInterceptor {// 白名单private static final Set<String> whiteList = new HashSet<>();static {whiteList.add("/index.html");}@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {System.out.println(request.getMethod());String url = request.getServletPath();if (whiteMatcher(url)) {return true;}String token = request.getHeader(tokenConfig.getHeader());System.out.println(token);return true;}@Overridepublic void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable Exception ex) throws Exception {LoginCache.removeUser(); // 从当前线程移除登录用户信息}
}

问题

• 业务拦截其中可能会拦截到"OPTIONS"类型的请求。

正确代码

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;import java.util.Arrays;
import java.util.Collections;@Configuration
public class CorsConfig {@Beanpublic CorsFilter corsFilter() {CorsConfiguration config = new CorsConfiguration();config.setAllowedOriginPatterns(Collections.singletonList("*"));config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));config.setAllowedHeaders(Collections.singletonList("*"));config.setAllowCredentials(true);config.setMaxAge(86400L);UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();source.registerCorsConfiguration("/**", config);return new CorsFilter(source);}
}

底层代码说明

• WebMvcConfigurer 方式：通过 addCorsMappings 配置的 CORS 规则会被封装为 HandlerMapping 级别的 CORS 处理器，它在 DispatcherServlet 处理请求时才会生效。
• CorsFilter 方式：直接注册 CorsFilter 作为一个独立的过滤器，它在 FilterChain 最前端执行，早于 DispatcherServlet 和所有拦截器。