錯誤代碼

• 跨域設置

@Configuration
public class WebConfig implements WebMvcConfigurer {/*** cors 跨域配置*/@Overridepublic void addCorsMappings(CorsRegistry registry) {registry.addMapping("/**").allowedMethods("GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS").allowCredentials(true).allowedOriginPatterns("*").allowCredentials(true).maxAge(3600);}
}

• 業務攔截器

public class LoginInterceptor implements HandlerInterceptor {// 白名單private static final Set<String> whiteList = new HashSet<>();static {whiteList.add("/index.html");}@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {System.out.println(request.getMethod());String url = request.getServletPath();if (whiteMatcher(url)) {return true;}String token = request.getHeader(tokenConfig.getHeader());System.out.println(token);return true;}@Overridepublic void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable Exception ex) throws Exception {LoginCache.removeUser(); // 從當前線程移除登錄用戶信息}
}

問題

• 業務攔截其中可能會攔截到"OPTIONS"類型的請求。

正確代碼

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;import java.util.Arrays;
import java.util.Collections;@Configuration
public class CorsConfig {@Beanpublic CorsFilter corsFilter() {CorsConfiguration config = new CorsConfiguration();config.setAllowedOriginPatterns(Collections.singletonList("*"));config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));config.setAllowedHeaders(Collections.singletonList("*"));config.setAllowCredentials(true);config.setMaxAge(86400L);UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();source.registerCorsConfiguration("/**", config);return new CorsFilter(source);}
}

底層代碼說明

• WebMvcConfigurer 方式：通過 addCorsMappings 配置的 CORS 規則會被封裝為 HandlerMapping 級別的 CORS 處理器，它在 DispatcherServlet 處理請求時才會生效。
• CorsFilter 方式：直接注冊 CorsFilter 作為一個獨立的過濾器，它在 FilterChain 最前端執行，早于 DispatcherServlet 和所有攔截器。