跨域入门-带cookie的跨域

最新推荐文章于 2025-01-20 21:04:49 发布

Andy2019

最新推荐文章于 2025-01-20 21:04:49 发布

阅读量280

点赞数

CC 4.0 BY-SA版权

分类专栏：跨域问题详解文章标签：跨域

本文链接：https://blog.csdn.net/Andy2019/article/details/102962438

跨域问题详解专栏收录该内容

5 篇文章

订阅专栏

本文探讨了跨域请求中Access-Control-Allow-Origin设置为*的局限性，特别是当请求涉及Cookie时。通过示例代码展示了如何正确配置跨域策略，包括使用特定源地址和设置Access-Control-Allow-Credentials为true，以及如何实现对所有域名的支持。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

网络上关于跨域的请求都是把Access-Control-Allow-Origin:*,但是这是否适合所有的场景呢？

package vip.fkandy;

import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@RestController
public class CorsController {
    
	@GetMapping("/getCookie")
    public ResultBean getCookie(@CookieValue(value="cookie1") String cookie){
		System.out.println("CorsController.getCookie()");
		return new ResultBean("getCookie" + cookie1);
	}
}

前端代码略

总结：带cookie的请求跨域是不能把Access-Control-Allow-Origin指定为*号的，修改为

res.addHeader("Access-Control-Allow-Origin","http://localhost:8081");

同时还需要指定Access-Control-Allow-Credentials等于true

package vip.fkandy;
 
import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
 
public class CrosFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse res = (HttpServletResponse)response;
		//支持cookie跨域Access-Control-Allow-Origin必须是全匹配
        res.addHeader("Access-Control-Allow-Origin","http://localhost:8081");
		//支持cookie跨域，必须指定Access-Control-Allow-Credentials等于true
		res.addHeader("Access-Control-Allow-Credentials","true");
        res.addHeader("Access-Control-Allow-Methods","*");
		res.addHeader("Access-Control-Allow-Headers","Content-Type");
		res.addHeader("Access-Control-Max-Age","3600");
        chain.doFilter(request,response);
    }
}

但是，目前只支持http://localhost:8081一个ip的带cookie跨域请求，如何支持所有域调用呢？


package vip.fkandy;
 
import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
 
public class CrosFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse res = (HttpServletResponse)response;
		HttpServletRequest req = (HttpServletRequest)request;
		//支持所有域名跨域
		String origin = req.getHeader("Origin");
		if(!StringUtils.isEmpty(origin)){
			res.addHeader("Access-Control-Allow-Origin",origin);
		}
		//支持cookie的相应头
		res.addHeader("Access-Control-Allow-Credentials","true");

        res.addHeader("Access-Control-Allow-Methods","*");
		res.addHeader("Access-Control-Allow-Headers","Content-Type");
		res.addHeader("Access-Control-Max-Age","3600");
        chain.doFilter(request,response);
    }
}