CORS 网站在 https 上调用 REST API 时出现问题

Question

I have a website running on https . I want this website to communicate with a REST Api service running on a AWS EC2 server. This service is implemented with Spring Boot and the Controller class contains the @CrossOrigin annotation with the origin website as a parameter. However I am getting following error while doing a POST request from the website with the service listening on port 443 with a self signed certificate:

  Access to XMLHttpRequest at x from origin y has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

And following one while doing a GET request:

  Access to XMLHttpRequest at x from origin y has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I also declared localhost in the service @CrossOrigin annotation.

It is failing with same error as above if I have my service run on port 443 with a self signed certificate, but it is working fine if I have my service running on port 8080 without SSL.

Do you know what I am doing wrong?

Also I guess that if I manage to solve the CORS issue I will still have a problem, as my certificate is self signed. How can I install a public certificate for a REST Api running in EC2 for example?

Thanks!

Answer 1

Add the config mentioned below to your spring-boot project.

@Configuration
public class CorsConfig {

    @Bean
    public CorsFilter corsFilter() {

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.addAllowedOrigin("*");
        config.addAllowedHeader("*");
        config.addAllowedMethod("OPTIONS");
        config.addAllowedMethod("HEAD");
        config.addAllowedMethod("GET");
        config.addAllowedMethod("PUT");
        config.addAllowedMethod("POST");
        config.addAllowedMethod("DELETE");
        config.addAllowedMethod("PATCH");
        source.registerCorsConfiguration("/**", config);
        return new CorsFilter(source);
    }
}