堆棧內存溢出
  簡體   English   中英

正確配置 vert.x 服務器以允許跨域資源共享 (CORS)

[英]Correctly configure vert.x server to allow Cross-origin resource sharing (CORS)

 原文  2017-10-29 14:14:15  8   2    javascript/ java/ html/ get/ vert.x

問題描述

我正在嘗試使用 vert.x 了解 CORS 配置。 我在這個 github 存儲庫的 CORS 部分下找到了一個示例。 當我嘗試它時，只有 POST 示例似乎有效（preflight.html）。 由於我還需要在我的一個項目中使用 GET (nopreflight.html)，因此我嘗試修改了獲得較差結果的示例。 這就是我現在所擁有的：

服務器端.java

package io.vertx.example.web.cors;
import io.vertx.core.AbstractVerticle;
import io.vertx.core.MultiMap;
import io.vertx.core.http.HttpMethod;
import io.vertx.example.util.Runner;
import io.vertx.ext.web.Router;
import io.vertx.ext.web.handler.CorsHandler;
import io.vertx.ext.web.handler.StaticHandler;

import java.util.Map;
/*
 * @author <a href="mailto:pmlopes@gmail.com">Paulo Lopes</a>
 */
public class Server extends AbstractVerticle {

    // Convenience method so you can run it in your IDE
    public static void main(String[] args) {
        Runner.runExample(Server.class);
    }

    @Override
    public void start() throws Exception {

        Router router = Router.router(vertx);

        router.route().handler(CorsHandler.create("*")
                           .allowedMethod(HttpMethod.GET)
                           .allowedMethod(HttpMethod.POST)
                           .allowedMethod(HttpMethod.OPTIONS)
                           .allowedHeader("Access-Control-Request-Method")
                           .allowedHeader("Access-Control-Allow-Credentials")
                           .allowedHeader("Access-Control-Allow-Origin")
                           .allowedHeader("Access-Control-Allow-Headers")
                           .allowedHeader("X-PINGARUNER")
                           .allowedHeader("Content-Type"));

        router.get("/access-control-with-get").handler(ctx -> {
            ctx.response().setChunked(true);

            MultiMap headers = ctx.request().headers();
            /*for (String key : headers.names()) {
              ctx.response().write(key);
              ctx.response().write(headers.get(key));
              ctx.response().write("\n");
            }*/
            ctx.response().write("response ");
            ctx.response().end();
        });

        router.post("/access-control-with-post-preflight").handler(ctx -> { ctx.response().setChunked(true);

            MultiMap headers = ctx.request().headers();
            /*for (String key : headers.names()) {
              ctx.response().write(key);
              ctx.response().write(headers.get(key));
              ctx.response().write("\n");
            }*/
            ctx.response().write("response ");
            ctx.response().end();
        });

        // Serve the static resources
        router.route().handler(StaticHandler.create());

        vertx.createHttpServer()
        .requestHandler(router::accept)
        .listen(8080);
    }
}

nopreflight.html

<?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Simple use of Cross-Site XMLHttpRequest (Using Access Control)</title>
<script type="text/javascript">
        //<![CDATA[

        var invocation = new XMLHttpRequest();
        var url = 'http://localhost:8080/access-control-with-get/';
        var invocationHistoryText;
        var body = '<?xml version="1.0"?><person><name>Arun</name></person>';

        function callOtherDomain(){
            if(invocation)
            {
                invocation.open('GET', url, true);
                //invocation.setRequestHeader('X-PINGARUNER', 'pingpong');
                invocation.setRequestHeader('Content-Type', 'application/xml');
                invocation.onreadystatechange = handler;
                invocation.send();
            }
            else
            {
                invocationHistoryText = "No Invocation TookPlace At All";
                var textNode = document.createTextNode(invocationHistoryText);
                var textDiv = document.getElementById("textDiv");
                textDiv.appendChild(textNode);
            }

        }
        function handler()
        {
            if (invocation.readyState == 4)
            {
                if (invocation.status == 200)
                {
                    var response = invocation.responseXML;
                    //var invocationHistory = response.getElementsByTagName('invocationHistory').item(0).firstChild.data;
                    invocationHistoryText = document.createTextNode(response);
                    var textDiv = document.getElementById("textDiv");
                    textDiv.appendChild(invocationHistoryText);

                }
                else
                    alert("Invocation Errors Occured " + invocation.readyState + " and the status is " + invocation.status);
            }
            else
                console.log("currently the application is at " + invocation.readyState);
        }
        //]]>


    </script>
</head>
<body>
<form id="controlsToInvoke" action="">
    <p>
        <input type="button" value="Click to Invoke Another Site" onclick="callOtherDomain()" />
    </p>
</form>
<p id="intro">
    This page basically makes invocations to another domain using cross-site XMLHttpRequest mitigated by Access Control.  This is the simple scenario that is <em>NOT</em> preflighted, and the invocation to a resource on another domain takes place using a simple HTTP GET.
</p>
<div id="textDiv">
    This XHTML document invokes another resource using cross-site XHR.
</div>
</body>
</html>

預檢.html

<?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Simple use of Cross-Site XMLHttpRequest (Using Access Control)</title>
<script type="text/javascript">
        //<![CDATA[

        var invocation = new XMLHttpRequest();
        var url = 'http://localhost:8080/access-control-with-post-preflight/';
        var invocationHistoryText;
        var body = '<?xml version="1.0"?><person><name>Arun</name></person>';

        function callOtherDomain(){
            if(invocation)
            {
                invocation.open('POST', url, true);
                invocation.setRequestHeader('X-PINGARUNER', 'pingpong');
                invocation.setRequestHeader('Content-Type', 'application/xml');
                invocation.onreadystatechange = handler;
                invocation.send();
            }
            else
            {
                invocationHistoryText = "No Invocation TookPlace At All";
                var textNode = document.createTextNode(invocationHistoryText);
                var textDiv = document.getElementById("textDiv");
                textDiv.appendChild(textNode);
            }

        }
        function handler()
        {
            if (invocation.readyState == 4)
            {
                if (invocation.status == 200)
                {
                    var response = invocation.responseText;
                    //var invocationHistory = response.getElementsByTagName('invocationHistory').item(0).firstChild.data;
                    invocationHistoryText = document.createTextNode(response);
                    var textDiv = document.getElementById("textDiv");
                    textDiv.appendChild(invocationHistoryText);

                }
                else
                {
                    alert("Invocation Errors Occured " + invocation.readyState + " and the status is " + invocation.status);
                }
            }
            else
            {
                console.log("currently the application is at " + invocation.readyState);
            }
        }
        //]]>


    </script>
</head>
<body>
<form id="controlsToInvoke" action="">
    <p>
        <input type="button" value="Click to Invoke Another Site" onclick="callOtherDomain()" />
    </p>
</form>
<p id="intro">
    This page POSTs XML data to another domain using cross-site XMLHttpRequest mitigated by Access Control.  This is the preflight scenario and the invocation to a resource on another domain takes place using first an OPTIONS request, then an actual POST request.
</p>
<div id="textDiv">
    This XHTML document POSTs to another resource using cross-site XHR.  If you get a response back, the content of that response should reflect what you POSTed.
</div>
</body>
</html>

編輯：多虧了一個建議，我修改了 Server.java 代碼以使其更清晰，我明白問題出在 nopreflight.html 文件中的 hanlder 函數。 我解決了這個問題如下：

編輯過的 Server.java

public class Server extends AbstractVerticle {

// Convenience method so you can run it in your IDE
public static void main(String[] args) {
    Runner.runExample(Server.class);
}

@Override
public void start() throws Exception {

    Router router = Router.router(vertx);

    Set<String> allowedHeaders = new HashSet<>();
    allowedHeaders.add("x-requested-with");
    allowedHeaders.add("Access-Control-Allow-Origin");
    allowedHeaders.add("origin");
    allowedHeaders.add("Content-Type");
    allowedHeaders.add("accept");
    allowedHeaders.add("X-PINGARUNER");

    Set<HttpMethod> allowedMethods = new HashSet<>();
    allowedMethods.add(HttpMethod.GET);
    allowedMethods.add(HttpMethod.POST);
    allowedMethods.add(HttpMethod.DELETE);
    allowedMethods.add(HttpMethod.PATCH);
    allowedMethods.add(HttpMethod.OPTIONS);
    allowedMethods.add(HttpMethod.PUT);


    router.route().handler(CorsHandler.create("*")
        .allowedHeaders(allowedHeaders)
        .allowedMethods(allowedMethods));

    router.get("/access-control-with-get").handler(ctx -> {
        HttpServerResponse httpServerResponse = ctx.response();
        httpServerResponse.putHeader("content-type", "text/html").end("<h1>Success</h1>");
    });

編輯 nopreflight.html

<script type="text/javascript">

    var xhttp = new XMLHttpRequest();
    var url = 'http://localhost:8080/access-control-with-get/';
    var invocationHistoryText;

    function callOtherDomain() {
        var xhttp = new XMLHttpRequest();
        xhttp.onreadystatechange = function() {
            if (this.readyState == 4 && this.status == 200) {
                document.getElementById("textDiv").appendChild(document.createTextNode(xhttp.responseText));
            }
        };
        xhttp.open("GET", url, true);
        xhttp.send();
    }

</script>

2 個解決方案

解決方案1
 2  2019-08-06 18:43:27

CorsHandler.create("*")將不起作用。
您需要在CorsHandler.create("Regex String Here")上提供一個正則CorsHandler.create("Regex String Here") 。 該正則表達式字符串需要是一個有效的 Java 正則表達式，可以在Pattern.compile("Regex String Here") 。 因此，如果您想通過 CORS 處理允許任何協議：主機：端口，又名“*”，您可以使用。

router.route().handler(CorsHandler.create(".*.");  //note the "." surrounding "*"

如果您想要對允許的協議：主機：端口進行細粒度控制，您可以使用正則表達式字符串進行創意。 例如，要為來自 localhost 和任何端口的 http:// 或 https:// 設置 CORS 處理：

router.route().handler(CorsHandler.create("((http:\\/\\/)|(https:\\/\\/))localhost:\\d+");

您還可以使用一個處理程序來允許來源白名單，例如：

router.route().handler(CorsHandler.create("http:\\/\\/localhost:8080|https:\\/\\/128.32.24.45:\\d+|http:\\/\\/121.0.4.3:8080"));

解決方案2
 1 已采納  2017-10-29 23:59:53

這對我們來說似乎很好用

    Router router = Router.router(vertx);

    Set<String> allowedHeaders = new HashSet<>();
    allowedHeaders.add("x-requested-with");
    allowedHeaders.add("Access-Control-Allow-Origin");
    allowedHeaders.add("origin");
    allowedHeaders.add("Content-Type");
    allowedHeaders.add("accept");

    Set<HttpMethod> allowedMethods = new HashSet<>();
    allowedMethods.add(HttpMethod.GET);
    allowedMethods.add(HttpMethod.POST);
    allowedMethods.add(HttpMethod.DELETE);
    allowedMethods.add(HttpMethod.PATCH);
    allowedMethods.add(HttpMethod.OPTIONS);
    allowedMethods.add(HttpMethod.PUT);

    router.route().handler(CorsHandler.create("*")
            .allowedHeaders(allowedHeaders)
            .allowedMethods(allowedMethods));

    router.get("/").handler(context1 -> {
        HttpServerResponse httpServerResponse = context1.response();
        httpServerResponse.putHeader("content-type", "text/html").end("<h1>Success</h1>");
    });

在此之后，如果您創建 httpserver，它應該可以正常工作。

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 跨域資源共享 (CORS) 概念 如何使用Joomla作為服務器配置跨源資源共享（CORS）？ 如何在play-framework 2.5.x中實現跨源資源共享（CORS） （CORS）-跨域資源共享連接問題 Amazon S3和跨源資源共享（CORS） 使用jQuery和Tornado進行跨源資源共享（CORS） Opera的跨源資源共享 在Meteor中啟用跨源資源共享？ 跨源資源共享和文件：// Tomcat 5.5的跨源資源共享
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM