如何在Spring Boot Cors中设置标头？

Question

I want to enable CORS in spring boot 2. I've done this as follows:

@Configuration
@EnableWebMvc
public class WebConfig implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedOrigins("*")
                .allowedMethods("*")
                .allowedHeaders("*");
    }
}

This work fine in most requests, but in some special request I need to set Access-Control-Allow-Origin header in response. How can I do it ?

Answer 1

There are many Ways to do this like using Filter or Interceptor or Aspects. You can also use WebFilter if you are using Spring 5.

One of the ways to do so is through Interceptors. Here is a rough code.

public class AccessControlInterceptor implements HandlerInterceptor {

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        if(somecondition) {
            response.setHeader("Access-Control-Allow-Origin", "your_value");
        }
    }
}

And register this Interceptor with spring like this

@Configuration
public class MyConfig extends WebMvcConfigurerAdapter{
    @Override
    public void addInterceptors(InterceptorRegistry registry){
        registry.addInterceptor(new AccessControlInterceptor ()).addPathPatterns("/**");
    }
}

Answer 2

From Spring documentation https://spring.io/guides/gs/rest-service-cors/

Enabling CORS Controller method CORS configuration So that the RESTful web service will include CORS access control headers in its response, you just have to add a @CrossOrigin annotation to the handler method:

@RestController
public class GreetingController {

    @CrossOrigin(origins = "http://localhost:9000")
    @GetMapping("/greeting")
    public Greeting greeting(@RequestParam(required=false, defaultValue="World") String name) {
        System.out.println("==== in greeting ====");
        return new Greeting(counter.incrementAndGet(),String.format(template, name));
}

This @CrossOrigin annotation enables cross-origin requests only for this specific method. By default, its allows all origins, all headers, the HTTP methods specified in the @RequestMapping annotation and a maxAge of 30 minutes is used. You can customize this behavior by specifying the value of one of the annotation attributes: origins, methods, allowedHeaders, exposedHeaders, allowCredentials or maxAge. In this example, we only allow http://localhost:9000 to send cross-origin requests.

it is also possible to add this annotation at controller class level as well, in order to enable CORS on all handler methods of this class.

Answer 3

Currently you are setting Access-Control-Allow-Origin to * which is a wildcard and matches all origins.

If your request contains credential related data, eg by setting XMLHttpRequest.withCredentials to true :

• Access-Control-Allow-Origin mustn't have the value *

• An additional response header Access-Control-Allow-Credentials with the value true is expected.