java - 来自邮递员的发布请求的跨源问题

Question

我正在编写一个具有跨源配置的 API

我的网络安全配置有

@Bean
    public FilterRegistrationBean corsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowCredentials(Boolean.TRUE);
        config.addAllowedOrigin("*");
        config.addAllowedHeader("*");
        config.addAllowedMethod("*");
        source.registerCorsConfiguration("/**", config);
        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
        bean.setOrder(0);
        return bean;
    }

    @Bean
    public FilterRegistrationBean someFilterRegistration() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(someFilter());
        registration.addUrlPatterns("/abc/*");
        registration.setOrder(1);
        return registration;
    }

控制器类

@CrossOrigin(origins = "*", maxAge = 3600)
@RestController
@RequestMapping("/gdpr/1.0")
public class AbcController {
 

    @PostMapping("/request")
    ReturnStatus saveRequest(HttpServletRequest request,
                             @RequestParam(value = "requestType", required = true) RequestType requestType,
                             @RequestParam(value = "Type", required = true) Type Type,
                             @RequestParam(value = "file", required = true)
                                     MultipartFile uploadedFile) throws InvalidInputException {
        
    }

我正在尝试满足我的邮递员的请求，如下所示

身份验证过滤器检查

private static final Pattern HEALTH_CHECK = Pattern.compile("^.+/abc/[\\d]+\\.[\\d]+/?$");
        @Override
            protected void doFilterInternal(HttpServletRequest request,
                                            HttpServletResponse response, FilterChain filterChain)
                    throws ServletException, IOException {
        
                StringBuffer requestURL = request.getRequestURL();
        
                if (isHealthCheck(requestURL)) {
                    filterChain.doFilter(request, response);
                    return;
                }
        
                String source = UNKNOWN;
    
    boolean isHealthCheck(StringBuffer requestURL) {
            if (requestURL != null) {
                Matcher matcher = HEALTH_CHECK.matcher(requestURL.toString());
                return matcher.matches();
            }
            return false;
        }

Matcher.match 总是假的

我错过了什么吗？

我添加了任何额外的参数吗？

期待快速响应。

Answer 1

403响应与 CORS 无关。

这可能是由CSRF 保护自动配置引起的。

您可以尝试禁用它：

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
    }
}