spring boot配置filter的两种方式，跨域，过滤http方法

最新推荐文章于 2025-04-12 10:36:17 发布

原创最新推荐文章于 2025-04-12 10:36:17 发布 · 460 阅读

0 ·

CC 4.0 BY-SA版权

本文介绍如何在SpringBoot项目中使用注解和手动配置方式实现跨域过滤器，解决HTTP请求中的预检请求问题，允许特定的访问方法和头信息。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

一、使用注解

package com.yd.filter;


import org.springframework.boot.web.servlet.ServletComponentScan;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @desc: 拦截http访问，过滤出get  post外方法，解决跨域问题
 * @author: cj
 * @time: 2019/12/30 10:07
 */
@Component
@ServletComponentScan
@WebFilter(urlPatterns = "/login/*",filterName = "loginFilter")
@Order(1)
public class UnsafeHttpFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse)servletResponse;
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
//        response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
        // 允许的访问方法
        response.setHeader("Access-Control-Allow-Methods","POST, GET, PUT, OPTIONS, PATCH");
        response.setHeader("Access-Control-Allow-Headers","Origin,jsessionid, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With,userId,token,x_localip");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        filterChain.doFilter(servletRequest,servletResponse);
    }

    @Override
    public void destroy() {

    }
}

二、手动配置
1、filter配置类

package com.yd.config;

import com.yd.filter.UnsafeHttpFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.stereotype.Component;

import java.util.ArrayList;
import java.util.List;

/**
 * @desc:
 * @author: cj
 * @time: 2019/12/30 12:21
 */
@Configuration
public class FilterConfig {

    @Bean
    public FilterRegistrationBean ajaxAuthenticationFilter() {
        FilterRegistrationBean authenticationFilter = new FilterRegistrationBean();
        UnsafeHttpFilter filter = new UnsafeHttpFilter();
//        filter.setServerLoginUrl(serverLoginUrl);
//        filter.setServiceName(redirctUrl);
        authenticationFilter.setFilter(filter);
        authenticationFilter.setOrder(1);
        List<String> urlPatterns = new ArrayList<>();
        urlPatterns.add("/*");// 设置匹配的url
        authenticationFilter.setUrlPatterns(urlPatterns);
        return authenticationFilter;
    }
}

2、filter类

package com.yd.filter;


import org.springframework.boot.web.servlet.ServletComponentScan;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @desc: 拦截http访问，过滤出get  post外方法
 * @author: cj
 * @time: 2019/12/30 10:07
 */

public class UnsafeHttpFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse)servletResponse;
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
//        response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
        // 允许的访问方法
        response.setHeader("Access-Control-Allow-Methods","POST, GET, PUT, OPTIONS, PATCH");
        response.setHeader("Access-Control-Allow-Headers","Origin,jsessionid, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With,userId,token,x_localip");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        filterChain.doFilter(servletRequest,servletResponse);
    }

    @Override
    public void destroy() {

    }
}